Warning: Permanently added '[localhost]:34468' (ECDSA) to the list of known hosts.
2026/01/18 17:59:32 fuzzer started
2026/01/18 17:59:32 dialing manager at localhost:42157
syzkaller login: [   52.154554] cgroup: Unknown subsys name 'net'
[   52.257122] cgroup: Unknown subsys name 'cpuset'
[   52.277319] cgroup: Unknown subsys name 'rlimit'
2026/01/18 17:59:44 syscalls: 201
2026/01/18 17:59:44 code coverage: enabled
2026/01/18 17:59:44 comparison tracing: enabled
2026/01/18 17:59:44 extra coverage: enabled
2026/01/18 17:59:44 setuid sandbox: enabled
2026/01/18 17:59:44 namespace sandbox: enabled
2026/01/18 17:59:44 Android sandbox: enabled
2026/01/18 17:59:44 fault injection: enabled
2026/01/18 17:59:44 leak checking: enabled
2026/01/18 17:59:44 net packet injection: enabled
2026/01/18 17:59:44 net device setup: enabled
2026/01/18 17:59:44 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2026/01/18 17:59:44 devlink PCI setup: PCI device 0000:00:10.0 is not available
2026/01/18 17:59:44 USB emulation: enabled
2026/01/18 17:59:44 hci packet injection: enabled
2026/01/18 17:59:44 wifi device emulation: enabled
2026/01/18 17:59:44 802.15.4 emulation: enabled
2026/01/18 17:59:44 fetching corpus: 0, signal 0/0 (executing program)
2026/01/18 17:59:45 starting 8 fuzzer processes
17:59:45 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
r5 = syz_open_dev$vcsn(&(0x7f0000000540), 0x6, 0x0)
r6 = shmget(0x1, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil)
shmat(r6, &(0x7f0000ffc000/0x3000)=nil, 0x5800)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), r5)
sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x20000008}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x3c, r8, 0xb00, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x400}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x200}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000802}, 0x1)

17:59:45 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

17:59:45 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)
r7 = pidfd_getfd(r1, r4, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r7, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffff01}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xd01c}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x40}}, 0x4040001)
r8 = openat$cgroup_ro(r4, &(0x7f0000000800)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0)
sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r8, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x24, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1f818ffbf8c06591}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x22}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x40040)

[   63.469239] audit: type=1400 audit(1768759185.650:7): avc:  denied  { execmem } for  pid=273 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
17:59:45 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r3, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r5 = pidfd_getfd(r3, r3, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
r8 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r9 = openat$cgroup_ro(r3, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r10=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000ac0)={<r11=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r4, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8, 0x1, r3}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r10}, {0x8, 0x1, r11}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x2c, r2, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}]}, 0x2c}}, 0x850)
openat$cgroup_subtree(r5, &(0x7f0000000d40), 0x2, 0x0)
ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f0000000d80)={{0x2, 0x4e20, @multicast1}, {0x6, @random="2ac8a2d76271"}, 0x0, {0x2, 0x4e21, @rand_addr=0x64010100}, 'ip6erspan0\x00'})
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000013c0)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001380)={&(0x7f0000001280)={0xf4, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8, 0x1, r11}, {0x8, 0x1, r5}, {0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4da}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r5}, {0x8, 0x1, r11}, {0x8}, {0x8}, {0x8, 0x1, r10}, {0x8, 0x1, r7}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc}]}, 0xf4}, 0x1, 0x0, 0x0, 0x80}, 0x408b0)

17:59:45 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
socketpair(0x26, 0xa, 0xfff, &(0x7f0000000a40)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDELRT(r7, 0x890c, &(0x7f0000000ac0)={0x0, {0x2, 0x4e24, @rand_addr=0x64010100}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x3f, &(0x7f0000000a80)='veth0_to_batadv\x00', 0x5, 0x8001, 0x3})
recvfrom(r7, &(0x7f0000000b40)=""/191, 0xbf, 0x10000, &(0x7f0000000c00)=@nl=@kern={0x10, 0x0, 0x0, 0x1}, 0x80)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000cc0), r5)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, r8, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000e00))

17:59:45 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r9, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000001600)=@filter={'filter\x00', 0xe, 0x3, 0xc52, [0x0, 0x20000980, 0x200009b0, 0x20000a9e], 0x0, &(0x7f0000000940), &(0x7f0000000980)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x11, 0x1, 0x8, 'wg2\x00', 'dummy0\x00', 'veth1_to_bond\x00', 'team_slave_1\x00', @random="6982dfaa4ba6", [0x0, 0x59426bcf115b84b4, 0x0, 0xff], @multicast, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x6e, 0xbe, [], [], @common=@log={'log\x00', 0x28, {{0x6, "f43e771caaacac8c023829ffbe53f68ed05d958bcbb4857287f00cb02222", 0x8}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{0x11, 0x8, 0x22f0, 'lo\x00', 'veth1_virt_wifi\x00', 'ipvlan1\x00', 'veth1_vlan\x00', @broadcast, [0x0, 0x0, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x956, 0x9ce, 0x9fe, [@helper={{'helper\x00', 0x0, 0x28}, {{0x0, 'syz1\x00'}}}, @among={{'among\x00', 0x0, 0x870}, {{@offset, @zero, 0x3, {[0x8, 0x1, 0x6, 0x3, 0x0, 0x6, 0x9a, 0xa7, 0xfff, 0x9, 0x2, 0xfffffffe, 0x1, 0x0, 0x93a, 0xff, 0x8, 0x4, 0x5c0e, 0x8, 0x1, 0x9, 0x20, 0x1, 0x7, 0x101, 0x0, 0x8, 0x401, 0x3ff, 0xffffffff, 0xed37, 0x3, 0xffffffff, 0xfa46, 0x7, 0x8, 0xe10, 0x7, 0x10001, 0x7fffffff, 0x1, 0x4, 0x2, 0x0, 0x40, 0x6, 0x7, 0x9, 0x1f, 0x10001, 0x6, 0x1ff, 0x7, 0x40, 0x64, 0x1000, 0x9, 0x5d01, 0x10001, 0x0, 0x6, 0x7, 0x10001, 0x5, 0x9, 0x7, 0x10000, 0x5, 0x10000, 0x10001, 0x9, 0x4, 0x7fffffff, 0x4, 0x1, 0x9, 0x93ec, 0x8, 0x2, 0x0, 0x401, 0x5, 0x10000, 0x1000, 0xef8, 0x2, 0x0, 0x6, 0x66, 0x3, 0x3ff, 0x5, 0x80000000, 0xb0e9, 0x1, 0x0, 0x8, 0x8, 0x0, 0x5, 0x7fff, 0x1000, 0x9, 0x4, 0x1, 0xd8, 0x97e5, 0x7, 0x0, 0xff, 0x7fffffff, 0x8, 0x401, 0x7, 0x8001, 0x0, 0x0, 0x80000001, 0x81, 0x2, 0x6, 0x6, 0x7, 0x0, 0xfff, 0x6, 0x0, 0x6, 0xfff, 0xc6c6, 0x401, 0xd2f, 0x8, 0x8, 0x80000000, 0x8, 0x6, 0x5, 0x401, 0x40, 0x80, 0x3ff, 0x2c, 0x4, 0x520, 0x0, 0x4, 0x3, 0x0, 0xb6, 0x9, 0x2, 0x0, 0x9, 0x0, 0x5, 0x7f, 0x10000, 0xfffffffd, 0x5a2c, 0x3ff, 0x2bbc, 0x200, 0x8001, 0x7f, 0x7, 0x5e9c, 0x0, 0x3, 0x800, 0xffffffff, 0x7, 0x89, 0xffff, 0x866, 0x9, 0x8, 0x5, 0x8001, 0x8, 0x2, 0x1000, 0x1000, 0x6, 0x400, 0x6, 0x8001, 0x8, 0x4, 0x7, 0xff, 0xcd, 0x6, 0x8001, 0xffff, 0x7, 0x80000001, 0x5, 0x3ff, 0x4, 0x101, 0xfffffffe, 0x8, 0x2c, 0x9, 0x2, 0x100, 0x7, 0x7, 0x1, 0x9, 0x2b1c, 0xff, 0x3, 0x6, 0x9, 0x4, 0xe7ad, 0x2, 0x1000, 0x4, 0x5, 0x8, 0x5, 0xd70, 0xa1f, 0x80000000, 0x5, 0x1, 0x4, 0x4, 0x1, 0x6, 0x4, 0x7, 0x7, 0xffffffd3, 0x5, 0x800, 0x8, 0x58aa5d24, 0x5, 0x17f, 0x40, 0xfff, 0x7fff, 0xffffff81, 0xb1, 0x80, 0x7, 0x70df, 0x190, 0x96, 0xfffffff9, 0x6, 0x2], 0x2, [{[0x9, 0x3], @broadcast}, {[0x1ff, 0x3d55], @broadcast}]}, {[0x7, 0x40000000, 0x6, 0x6, 0x6, 0x4, 0xd0, 0x2, 0x5, 0x3, 0x5, 0xffff9c04, 0x7fffffff, 0x7fff, 0x1f, 0x0, 0x6, 0xfffffc00, 0x3100, 0x6, 0x1, 0x40, 0x3, 0x5, 0x9e60, 0x5, 0x0, 0x7, 0x1, 0x4, 0x6, 0xfc, 0x3, 0x6, 0x7, 0x401, 0x7fffffff, 0x81, 0x3, 0x9, 0x5f, 0xa12, 0x0, 0x6, 0x4680, 0x5, 0x6, 0x6, 0x6, 0x3ecd, 0x841e, 0x100, 0xffffffff, 0x80000000, 0xfffffff9, 0x800, 0x7, 0x2, 0x0, 0x48e, 0x0, 0x200, 0x0, 0x9, 0x7, 0x5, 0xfffffffc, 0x9, 0x5, 0x1, 0x1, 0x17, 0x45d1, 0x1000000, 0x5, 0x7fffffff, 0x1, 0x72, 0x7, 0x0, 0x3a1, 0x5a2480e5, 0x5, 0x1, 0x5, 0x7fffffff, 0xffffffff, 0x5, 0xbf, 0x8000, 0x9, 0x9000, 0xf311, 0x400, 0xffffffe1, 0x8b21, 0x3, 0x8000, 0x0, 0x9, 0x63, 0x6, 0x7, 0x7fff, 0x0, 0x7, 0x2, 0xd0, 0x5, 0xffff, 0x46, 0x800, 0x5, 0x6, 0xbf1, 0x6, 0x3, 0x1, 0x2, 0x45, 0x0, 0x0, 0x547, 0xfffffffd, 0x9, 0x0, 0x3, 0xffffffff, 0x101, 0x3f, 0x9, 0x6, 0x4b, 0x2, 0x101, 0x9, 0x80, 0xfff, 0x8000, 0x5, 0x5, 0xffffffff, 0x0, 0xae8, 0x2, 0x6, 0x4, 0x0, 0x6, 0xe39, 0xbf9, 0xd17, 0xfffff001, 0x8c55, 0x81, 0x800, 0x9, 0x1000, 0xfffffffa, 0x7, 0x20000000, 0x9, 0x5, 0x3, 0x8001, 0x3, 0x9, 0x5, 0x1f, 0x0, 0x10000, 0x2, 0x1000, 0x0, 0x38000, 0x0, 0x7f, 0x6, 0xfff, 0x3f, 0x3, 0x0, 0x1, 0x74f7f541, 0x8001, 0x5, 0x0, 0x8, 0x9, 0x400, 0x100, 0x80000000, 0x6, 0x5, 0x3, 0x2, 0x2, 0x6, 0x8, 0x6, 0x8000, 0x1, 0x8, 0x1ff, 0x6, 0xfffffff9, 0xfffffff7, 0x1f, 0xfff, 0x7, 0x4, 0x5, 0x9, 0xfffffff9, 0x9, 0x1, 0x5, 0x5, 0x6, 0x2ef, 0x1, 0x3, 0x1, 0x4, 0x27e7, 0x6, 0x99d0, 0x7e1, 0x5, 0x4222, 0x10000, 0x4ab6, 0x2, 0x45f, 0x81, 0x6, 0x100, 0xff, 0x9, 0x2, 0x8, 0x4, 0x0, 0x6, 0x1ff, 0xff, 0x2, 0x81, 0x1, 0xfffffff9, 0x99, 0xfffffffa, 0x3, 0x8, 0x1ff, 0x401, 0x8], 0x5, [{[0x2, 0x81], @private=0xa010102}, {[0x9, 0x7], @dev={0xac, 0x14, 0x14, 0x20}}, {[0xffff0001, 0x7fff], @multicast1}, {[0x80000000, 0x6], @broadcast}, {[0x0, 0x9], @broadcast}]}}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x12, 0xff, {0x100}}}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}], @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}, {0x3, 0x65, 0x4, 'bridge_slave_0\x00', 'geneve0\x00', 'netdevsim0\x00', 'vlan1\x00', @random="0f083534cf61", [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x9e, 0xd6, [], [@common=@AUDIT={'AUDIT\x00', 0x8}], @common=@mark={'mark\x00', 0x10, {{0xffffffe0, 0xfffffffffffffffd}}}}]}]}, 0xcca)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000001840)={&(0x7f0000001680), 0xc, &(0x7f0000001800)={&(0x7f0000001780)={0x44, 0x0, 0x800, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_PID={0x8}, @NL802154_ATTR_PID={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8804}, 0x4001)

17:59:45 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000600)={<r7=>0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x40182103, &(0x7f0000000680)={r7, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

17:59:45 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x54, r5, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40040e0}, 0x1)
r6 = pidfd_getfd(0xffffffffffffffff, r4, 0x0)
mknodat$loop(r6, &(0x7f0000000580)='./file0\x00', 0x1, 0x1)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)
ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r7, 0x80083314, &(0x7f0000000600))

[   64.581737] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   64.583973] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   64.585722] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   64.590396] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   64.595016] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   64.653034] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   64.654918] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   64.656525] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   64.674521] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   64.690516] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   64.709227] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   64.711750] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   64.714903] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   64.716145] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   64.717337] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   64.719187] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   64.720457] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   64.721807] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   64.737727] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   64.738800] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   64.772818] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   64.777154] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   64.780872] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   64.784783] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   64.787743] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[   64.794623] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[   64.796205] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[   64.798612] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[   64.800495] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[   64.802852] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[   64.809998] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   64.812487] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   64.813227] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[   64.814264] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[   64.815674] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[   64.819302] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[   64.822301] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   64.824626] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   64.830021] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   64.833019] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   66.618555] Bluetooth: hci0: command tx timeout
[   66.745501] Bluetooth: hci3: command tx timeout
[   66.745573] Bluetooth: hci1: command tx timeout
[   66.810274] Bluetooth: hci2: command tx timeout
[   66.873533] Bluetooth: hci6: command tx timeout
[   66.874336] Bluetooth: hci7: command tx timeout
[   66.874557] Bluetooth: hci4: command tx timeout
[   66.938560] Bluetooth: hci5: command tx timeout
[   68.667074] Bluetooth: hci0: command tx timeout
[   68.793933] Bluetooth: hci1: command tx timeout
[   68.794541] Bluetooth: hci3: command tx timeout
[   68.859197] Bluetooth: hci2: command tx timeout
[   68.921518] Bluetooth: hci7: command tx timeout
[   68.921603] Bluetooth: hci4: command tx timeout
[   68.921968] Bluetooth: hci6: command tx timeout
[   68.985482] Bluetooth: hci5: command tx timeout
[   70.713476] Bluetooth: hci0: command tx timeout
[   70.841517] Bluetooth: hci3: command tx timeout
[   70.841539] Bluetooth: hci1: command tx timeout
[   70.906527] Bluetooth: hci2: command tx timeout
[   70.969508] Bluetooth: hci6: command tx timeout
[   70.969966] Bluetooth: hci7: command tx timeout
[   70.970357] Bluetooth: hci4: command tx timeout
[   71.033526] Bluetooth: hci5: command tx timeout
[   72.761472] Bluetooth: hci0: command tx timeout
[   72.889550] Bluetooth: hci1: command tx timeout
[   72.890012] Bluetooth: hci3: command tx timeout
[   72.953506] Bluetooth: hci2: command tx timeout
[   73.017597] Bluetooth: hci4: command tx timeout
[   73.019057] Bluetooth: hci7: command tx timeout
[   73.020738] Bluetooth: hci6: command tx timeout
[   73.081567] Bluetooth: hci5: command tx timeout
[   96.681706] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.682354] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.697220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.698284] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.181899] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.182566] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.306273] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.306972] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.469756] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.470379] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.596602] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.597283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  101.570750] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  101.571374] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  101.635946] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  101.636603] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  101.692773] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  101.693402] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  101.754601] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  101.755175] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  101.816226] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  101.817236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  101.879343] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  101.881256] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  103.113330] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  103.114415] Bluetooth: hci0: Opcode 0x0406 failed: -4
[  103.121265] Bluetooth: hci0: Opcode 0x0406 failed: -4
[  103.124185] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  103.125000] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  103.127879] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  103.130384] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  103.131182] Bluetooth: hci2: Opcode 0x0406 failed: -4
[  103.134335] Bluetooth: hci2: Opcode 0x0406 failed: -4
[  103.136699] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  103.140018] Bluetooth: hci3: Opcode 0x0406 failed: -4
[  103.142586] Bluetooth: hci3: Opcode 0x0406 failed: -4
[  103.145047] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  103.145859] Bluetooth: hci4: Opcode 0x0406 failed: -4
[  103.148819] Bluetooth: hci4: Opcode 0x0406 failed: -4
[  103.151814] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  103.152584] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  103.155305] Bluetooth: hci5: Opcode 0x0406 failed: -4
[  103.164402] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  103.165397] Bluetooth: hci6: Opcode 0x0406 failed: -4
[  103.168849] Bluetooth: hci6: Opcode 0x0406 failed: -4
[  103.172020] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  103.173885] Bluetooth: hci7: Opcode 0x0406 failed: -4
[  103.178811] Bluetooth: hci7: Opcode 0x0406 failed: -4
[  103.215638] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  103.216206] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  103.294009] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  103.295532] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  103.295939] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  103.296936] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  103.353953] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  103.354755] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  104.423055] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  104.424568] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  104.425998] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  104.427618] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  104.429241] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  104.430824] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  104.432695] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  104.434397] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  105.593678] Bluetooth: hci0: command 0x0c1a tx timeout
[  106.490492] Bluetooth: hci7: command 0x0c1a tx timeout
[  106.490636] Bluetooth: hci6: command 0x0c1a tx timeout
[  106.491567] Bluetooth: hci5: command 0x0c1a tx timeout
[  106.492596] Bluetooth: hci4: command 0x0c1a tx timeout
[  106.492652] Bluetooth: hci3: command 0x0c1a tx timeout
[  106.495399] Bluetooth: hci2: command 0x0c1a tx timeout
[  106.495679] Bluetooth: hci1: command 0x0c1a tx timeout
[  107.644616] Bluetooth: hci0: command 0x0c1a tx timeout
[  108.537553] Bluetooth: hci2: command 0x0c1a tx timeout
[  108.538502] Bluetooth: hci1: command 0x0c1a tx timeout
[  108.538508] Bluetooth: hci6: command 0x0c1a tx timeout
[  108.538535] Bluetooth: hci5: command 0x0c1a tx timeout
[  108.539111] Bluetooth: hci3: command 0x0c1a tx timeout
[  108.540003] Bluetooth: hci4: command 0x0c1a tx timeout
[  108.540535] Bluetooth: hci7: command 0x0c1a tx timeout
[  109.689868] Bluetooth: hci0: command 0x0c1a tx timeout
[  110.585626] Bluetooth: hci3: command 0x0c1a tx timeout
[  110.585678] Bluetooth: hci7: command 0x0c1a tx timeout
[  110.586847] Bluetooth: hci2: command 0x0c1a tx timeout
[  110.587819] Bluetooth: hci4: command 0x0c1a tx timeout
[  110.589125] Bluetooth: hci5: command 0x0c1a tx timeout
[  110.590974] Bluetooth: hci1: command 0x0c1a tx timeout
[  110.591571] Bluetooth: hci6: command 0x0c1a tx timeout
18:00:36 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r9, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000001600)=@filter={'filter\x00', 0xe, 0x3, 0xc52, [0x0, 0x20000980, 0x200009b0, 0x20000a9e], 0x0, &(0x7f0000000940), &(0x7f0000000980)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x11, 0x1, 0x8, 'wg2\x00', 'dummy0\x00', 'veth1_to_bond\x00', 'team_slave_1\x00', @random="6982dfaa4ba6", [0x0, 0x59426bcf115b84b4, 0x0, 0xff], @multicast, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x6e, 0xbe, [], [], @common=@log={'log\x00', 0x28, {{0x6, "f43e771caaacac8c023829ffbe53f68ed05d958bcbb4857287f00cb02222", 0x8}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{0x11, 0x8, 0x22f0, 'lo\x00', 'veth1_virt_wifi\x00', 'ipvlan1\x00', 'veth1_vlan\x00', @broadcast, [0x0, 0x0, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x956, 0x9ce, 0x9fe, [@helper={{'helper\x00', 0x0, 0x28}, {{0x0, 'syz1\x00'}}}, @among={{'among\x00', 0x0, 0x870}, {{@offset, @zero, 0x3, {[0x8, 0x1, 0x6, 0x3, 0x0, 0x6, 0x9a, 0xa7, 0xfff, 0x9, 0x2, 0xfffffffe, 0x1, 0x0, 0x93a, 0xff, 0x8, 0x4, 0x5c0e, 0x8, 0x1, 0x9, 0x20, 0x1, 0x7, 0x101, 0x0, 0x8, 0x401, 0x3ff, 0xffffffff, 0xed37, 0x3, 0xffffffff, 0xfa46, 0x7, 0x8, 0xe10, 0x7, 0x10001, 0x7fffffff, 0x1, 0x4, 0x2, 0x0, 0x40, 0x6, 0x7, 0x9, 0x1f, 0x10001, 0x6, 0x1ff, 0x7, 0x40, 0x64, 0x1000, 0x9, 0x5d01, 0x10001, 0x0, 0x6, 0x7, 0x10001, 0x5, 0x9, 0x7, 0x10000, 0x5, 0x10000, 0x10001, 0x9, 0x4, 0x7fffffff, 0x4, 0x1, 0x9, 0x93ec, 0x8, 0x2, 0x0, 0x401, 0x5, 0x10000, 0x1000, 0xef8, 0x2, 0x0, 0x6, 0x66, 0x3, 0x3ff, 0x5, 0x80000000, 0xb0e9, 0x1, 0x0, 0x8, 0x8, 0x0, 0x5, 0x7fff, 0x1000, 0x9, 0x4, 0x1, 0xd8, 0x97e5, 0x7, 0x0, 0xff, 0x7fffffff, 0x8, 0x401, 0x7, 0x8001, 0x0, 0x0, 0x80000001, 0x81, 0x2, 0x6, 0x6, 0x7, 0x0, 0xfff, 0x6, 0x0, 0x6, 0xfff, 0xc6c6, 0x401, 0xd2f, 0x8, 0x8, 0x80000000, 0x8, 0x6, 0x5, 0x401, 0x40, 0x80, 0x3ff, 0x2c, 0x4, 0x520, 0x0, 0x4, 0x3, 0x0, 0xb6, 0x9, 0x2, 0x0, 0x9, 0x0, 0x5, 0x7f, 0x10000, 0xfffffffd, 0x5a2c, 0x3ff, 0x2bbc, 0x200, 0x8001, 0x7f, 0x7, 0x5e9c, 0x0, 0x3, 0x800, 0xffffffff, 0x7, 0x89, 0xffff, 0x866, 0x9, 0x8, 0x5, 0x8001, 0x8, 0x2, 0x1000, 0x1000, 0x6, 0x400, 0x6, 0x8001, 0x8, 0x4, 0x7, 0xff, 0xcd, 0x6, 0x8001, 0xffff, 0x7, 0x80000001, 0x5, 0x3ff, 0x4, 0x101, 0xfffffffe, 0x8, 0x2c, 0x9, 0x2, 0x100, 0x7, 0x7, 0x1, 0x9, 0x2b1c, 0xff, 0x3, 0x6, 0x9, 0x4, 0xe7ad, 0x2, 0x1000, 0x4, 0x5, 0x8, 0x5, 0xd70, 0xa1f, 0x80000000, 0x5, 0x1, 0x4, 0x4, 0x1, 0x6, 0x4, 0x7, 0x7, 0xffffffd3, 0x5, 0x800, 0x8, 0x58aa5d24, 0x5, 0x17f, 0x40, 0xfff, 0x7fff, 0xffffff81, 0xb1, 0x80, 0x7, 0x70df, 0x190, 0x96, 0xfffffff9, 0x6, 0x2], 0x2, [{[0x9, 0x3], @broadcast}, {[0x1ff, 0x3d55], @broadcast}]}, {[0x7, 0x40000000, 0x6, 0x6, 0x6, 0x4, 0xd0, 0x2, 0x5, 0x3, 0x5, 0xffff9c04, 0x7fffffff, 0x7fff, 0x1f, 0x0, 0x6, 0xfffffc00, 0x3100, 0x6, 0x1, 0x40, 0x3, 0x5, 0x9e60, 0x5, 0x0, 0x7, 0x1, 0x4, 0x6, 0xfc, 0x3, 0x6, 0x7, 0x401, 0x7fffffff, 0x81, 0x3, 0x9, 0x5f, 0xa12, 0x0, 0x6, 0x4680, 0x5, 0x6, 0x6, 0x6, 0x3ecd, 0x841e, 0x100, 0xffffffff, 0x80000000, 0xfffffff9, 0x800, 0x7, 0x2, 0x0, 0x48e, 0x0, 0x200, 0x0, 0x9, 0x7, 0x5, 0xfffffffc, 0x9, 0x5, 0x1, 0x1, 0x17, 0x45d1, 0x1000000, 0x5, 0x7fffffff, 0x1, 0x72, 0x7, 0x0, 0x3a1, 0x5a2480e5, 0x5, 0x1, 0x5, 0x7fffffff, 0xffffffff, 0x5, 0xbf, 0x8000, 0x9, 0x9000, 0xf311, 0x400, 0xffffffe1, 0x8b21, 0x3, 0x8000, 0x0, 0x9, 0x63, 0x6, 0x7, 0x7fff, 0x0, 0x7, 0x2, 0xd0, 0x5, 0xffff, 0x46, 0x800, 0x5, 0x6, 0xbf1, 0x6, 0x3, 0x1, 0x2, 0x45, 0x0, 0x0, 0x547, 0xfffffffd, 0x9, 0x0, 0x3, 0xffffffff, 0x101, 0x3f, 0x9, 0x6, 0x4b, 0x2, 0x101, 0x9, 0x80, 0xfff, 0x8000, 0x5, 0x5, 0xffffffff, 0x0, 0xae8, 0x2, 0x6, 0x4, 0x0, 0x6, 0xe39, 0xbf9, 0xd17, 0xfffff001, 0x8c55, 0x81, 0x800, 0x9, 0x1000, 0xfffffffa, 0x7, 0x20000000, 0x9, 0x5, 0x3, 0x8001, 0x3, 0x9, 0x5, 0x1f, 0x0, 0x10000, 0x2, 0x1000, 0x0, 0x38000, 0x0, 0x7f, 0x6, 0xfff, 0x3f, 0x3, 0x0, 0x1, 0x74f7f541, 0x8001, 0x5, 0x0, 0x8, 0x9, 0x400, 0x100, 0x80000000, 0x6, 0x5, 0x3, 0x2, 0x2, 0x6, 0x8, 0x6, 0x8000, 0x1, 0x8, 0x1ff, 0x6, 0xfffffff9, 0xfffffff7, 0x1f, 0xfff, 0x7, 0x4, 0x5, 0x9, 0xfffffff9, 0x9, 0x1, 0x5, 0x5, 0x6, 0x2ef, 0x1, 0x3, 0x1, 0x4, 0x27e7, 0x6, 0x99d0, 0x7e1, 0x5, 0x4222, 0x10000, 0x4ab6, 0x2, 0x45f, 0x81, 0x6, 0x100, 0xff, 0x9, 0x2, 0x8, 0x4, 0x0, 0x6, 0x1ff, 0xff, 0x2, 0x81, 0x1, 0xfffffff9, 0x99, 0xfffffffa, 0x3, 0x8, 0x1ff, 0x401, 0x8], 0x5, [{[0x2, 0x81], @private=0xa010102}, {[0x9, 0x7], @dev={0xac, 0x14, 0x14, 0x20}}, {[0xffff0001, 0x7fff], @multicast1}, {[0x80000000, 0x6], @broadcast}, {[0x0, 0x9], @broadcast}]}}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x12, 0xff, {0x100}}}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}], @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}, {0x3, 0x65, 0x4, 'bridge_slave_0\x00', 'geneve0\x00', 'netdevsim0\x00', 'vlan1\x00', @random="0f083534cf61", [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x9e, 0xd6, [], [@common=@AUDIT={'AUDIT\x00', 0x8}], @common=@mark={'mark\x00', 0x10, {{0xffffffe0, 0xfffffffffffffffd}}}}]}]}, 0xcca)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000001840)={&(0x7f0000001680), 0xc, &(0x7f0000001800)={&(0x7f0000001780)={0x44, 0x0, 0x800, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_PID={0x8}, @NL802154_ATTR_PID={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8804}, 0x4001)

18:00:36 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
r5 = syz_open_dev$vcsn(&(0x7f0000000540), 0x6, 0x0)
r6 = shmget(0x1, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil)
shmat(r6, &(0x7f0000ffc000/0x3000)=nil, 0x5800)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), r5)
sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x20000008}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x3c, r8, 0xb00, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x400}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x200}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000802}, 0x1)

18:00:36 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)
r7 = pidfd_getfd(r1, r4, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r7, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffff01}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xd01c}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x40}}, 0x4040001)
r8 = openat$cgroup_ro(r4, &(0x7f0000000800)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0)
sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r8, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x24, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1f818ffbf8c06591}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x22}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x40040)

18:00:36 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r3, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r5 = pidfd_getfd(r3, r3, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
r8 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r9 = openat$cgroup_ro(r3, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r10=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000ac0)={<r11=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r4, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8, 0x1, r3}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r10}, {0x8, 0x1, r11}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x2c, r2, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}]}, 0x2c}}, 0x850)
openat$cgroup_subtree(r5, &(0x7f0000000d40), 0x2, 0x0)
ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f0000000d80)={{0x2, 0x4e20, @multicast1}, {0x6, @random="2ac8a2d76271"}, 0x0, {0x2, 0x4e21, @rand_addr=0x64010100}, 'ip6erspan0\x00'})
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000013c0)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001380)={&(0x7f0000001280)={0xf4, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8, 0x1, r11}, {0x8, 0x1, r5}, {0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4da}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r5}, {0x8, 0x1, r11}, {0x8}, {0x8}, {0x8, 0x1, r10}, {0x8, 0x1, r7}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc}]}, 0xf4}, 0x1, 0x0, 0x0, 0x80}, 0x408b0)

18:00:36 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000600)={<r7=>0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x40182103, &(0x7f0000000680)={r7, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:00:36 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x54, r5, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40040e0}, 0x1)
r6 = pidfd_getfd(0xffffffffffffffff, r4, 0x0)
mknodat$loop(r6, &(0x7f0000000580)='./file0\x00', 0x1, 0x1)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)
ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r7, 0x80083314, &(0x7f0000000600))

18:00:36 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:00:36 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
socketpair(0x26, 0xa, 0xfff, &(0x7f0000000a40)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDELRT(r7, 0x890c, &(0x7f0000000ac0)={0x0, {0x2, 0x4e24, @rand_addr=0x64010100}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x3f, &(0x7f0000000a80)='veth0_to_batadv\x00', 0x5, 0x8001, 0x3})
recvfrom(r7, &(0x7f0000000b40)=""/191, 0xbf, 0x10000, &(0x7f0000000c00)=@nl=@kern={0x10, 0x0, 0x0, 0x1}, 0x80)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000cc0), r5)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, r8, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000e00))

18:00:36 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000600)={<r7=>0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x40182103, &(0x7f0000000680)={r7, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:00:36 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
r5 = syz_open_dev$vcsn(&(0x7f0000000540), 0x6, 0x0)
r6 = shmget(0x1, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil)
shmat(r6, &(0x7f0000ffc000/0x3000)=nil, 0x5800)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), r5)
sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x20000008}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x3c, r8, 0xb00, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x400}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x200}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000802}, 0x1)

[  115.403888] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  115.404653] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  115.405283] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  115.406860] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  115.407643] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  115.408297] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  115.409110] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  115.409845] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  116.666483] Bluetooth: hci0: command 0x0c1a tx timeout
[  117.434564] Bluetooth: hci7: command 0x0c1a tx timeout
[  117.435630] Bluetooth: hci6: command 0x0c1a tx timeout
[  117.436486] Bluetooth: hci5: command 0x0c1a tx timeout
[  117.436609] Bluetooth: hci4: command 0x0c1a tx timeout
[  117.437398] Bluetooth: hci3: command 0x0c1a tx timeout
[  117.438561] Bluetooth: hci2: command 0x0c1a tx timeout
[  117.439150] Bluetooth: hci1: command 0x0c1a tx timeout
18:00:45 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000600)={<r7=>0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x40182103, &(0x7f0000000680)={r7, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:00:45 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
socketpair(0x26, 0xa, 0xfff, &(0x7f0000000a40)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDELRT(r7, 0x890c, &(0x7f0000000ac0)={0x0, {0x2, 0x4e24, @rand_addr=0x64010100}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x3f, &(0x7f0000000a80)='veth0_to_batadv\x00', 0x5, 0x8001, 0x3})
recvfrom(r7, &(0x7f0000000b40)=""/191, 0xbf, 0x10000, &(0x7f0000000c00)=@nl=@kern={0x10, 0x0, 0x0, 0x1}, 0x80)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000cc0), r5)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, r8, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000e00))

18:00:45 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x54, r5, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40040e0}, 0x1)
r6 = pidfd_getfd(0xffffffffffffffff, r4, 0x0)
mknodat$loop(r6, &(0x7f0000000580)='./file0\x00', 0x1, 0x1)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)
ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r7, 0x80083314, &(0x7f0000000600))

18:00:45 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)
r7 = pidfd_getfd(r1, r4, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r7, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffff01}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xd01c}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x40}}, 0x4040001)
r8 = openat$cgroup_ro(r4, &(0x7f0000000800)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0)
sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r8, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x24, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1f818ffbf8c06591}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x22}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x40040)

18:00:45 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r9, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000001600)=@filter={'filter\x00', 0xe, 0x3, 0xc52, [0x0, 0x20000980, 0x200009b0, 0x20000a9e], 0x0, &(0x7f0000000940), &(0x7f0000000980)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x11, 0x1, 0x8, 'wg2\x00', 'dummy0\x00', 'veth1_to_bond\x00', 'team_slave_1\x00', @random="6982dfaa4ba6", [0x0, 0x59426bcf115b84b4, 0x0, 0xff], @multicast, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x6e, 0xbe, [], [], @common=@log={'log\x00', 0x28, {{0x6, "f43e771caaacac8c023829ffbe53f68ed05d958bcbb4857287f00cb02222", 0x8}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{0x11, 0x8, 0x22f0, 'lo\x00', 'veth1_virt_wifi\x00', 'ipvlan1\x00', 'veth1_vlan\x00', @broadcast, [0x0, 0x0, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x956, 0x9ce, 0x9fe, [@helper={{'helper\x00', 0x0, 0x28}, {{0x0, 'syz1\x00'}}}, @among={{'among\x00', 0x0, 0x870}, {{@offset, @zero, 0x3, {[0x8, 0x1, 0x6, 0x3, 0x0, 0x6, 0x9a, 0xa7, 0xfff, 0x9, 0x2, 0xfffffffe, 0x1, 0x0, 0x93a, 0xff, 0x8, 0x4, 0x5c0e, 0x8, 0x1, 0x9, 0x20, 0x1, 0x7, 0x101, 0x0, 0x8, 0x401, 0x3ff, 0xffffffff, 0xed37, 0x3, 0xffffffff, 0xfa46, 0x7, 0x8, 0xe10, 0x7, 0x10001, 0x7fffffff, 0x1, 0x4, 0x2, 0x0, 0x40, 0x6, 0x7, 0x9, 0x1f, 0x10001, 0x6, 0x1ff, 0x7, 0x40, 0x64, 0x1000, 0x9, 0x5d01, 0x10001, 0x0, 0x6, 0x7, 0x10001, 0x5, 0x9, 0x7, 0x10000, 0x5, 0x10000, 0x10001, 0x9, 0x4, 0x7fffffff, 0x4, 0x1, 0x9, 0x93ec, 0x8, 0x2, 0x0, 0x401, 0x5, 0x10000, 0x1000, 0xef8, 0x2, 0x0, 0x6, 0x66, 0x3, 0x3ff, 0x5, 0x80000000, 0xb0e9, 0x1, 0x0, 0x8, 0x8, 0x0, 0x5, 0x7fff, 0x1000, 0x9, 0x4, 0x1, 0xd8, 0x97e5, 0x7, 0x0, 0xff, 0x7fffffff, 0x8, 0x401, 0x7, 0x8001, 0x0, 0x0, 0x80000001, 0x81, 0x2, 0x6, 0x6, 0x7, 0x0, 0xfff, 0x6, 0x0, 0x6, 0xfff, 0xc6c6, 0x401, 0xd2f, 0x8, 0x8, 0x80000000, 0x8, 0x6, 0x5, 0x401, 0x40, 0x80, 0x3ff, 0x2c, 0x4, 0x520, 0x0, 0x4, 0x3, 0x0, 0xb6, 0x9, 0x2, 0x0, 0x9, 0x0, 0x5, 0x7f, 0x10000, 0xfffffffd, 0x5a2c, 0x3ff, 0x2bbc, 0x200, 0x8001, 0x7f, 0x7, 0x5e9c, 0x0, 0x3, 0x800, 0xffffffff, 0x7, 0x89, 0xffff, 0x866, 0x9, 0x8, 0x5, 0x8001, 0x8, 0x2, 0x1000, 0x1000, 0x6, 0x400, 0x6, 0x8001, 0x8, 0x4, 0x7, 0xff, 0xcd, 0x6, 0x8001, 0xffff, 0x7, 0x80000001, 0x5, 0x3ff, 0x4, 0x101, 0xfffffffe, 0x8, 0x2c, 0x9, 0x2, 0x100, 0x7, 0x7, 0x1, 0x9, 0x2b1c, 0xff, 0x3, 0x6, 0x9, 0x4, 0xe7ad, 0x2, 0x1000, 0x4, 0x5, 0x8, 0x5, 0xd70, 0xa1f, 0x80000000, 0x5, 0x1, 0x4, 0x4, 0x1, 0x6, 0x4, 0x7, 0x7, 0xffffffd3, 0x5, 0x800, 0x8, 0x58aa5d24, 0x5, 0x17f, 0x40, 0xfff, 0x7fff, 0xffffff81, 0xb1, 0x80, 0x7, 0x70df, 0x190, 0x96, 0xfffffff9, 0x6, 0x2], 0x2, [{[0x9, 0x3], @broadcast}, {[0x1ff, 0x3d55], @broadcast}]}, {[0x7, 0x40000000, 0x6, 0x6, 0x6, 0x4, 0xd0, 0x2, 0x5, 0x3, 0x5, 0xffff9c04, 0x7fffffff, 0x7fff, 0x1f, 0x0, 0x6, 0xfffffc00, 0x3100, 0x6, 0x1, 0x40, 0x3, 0x5, 0x9e60, 0x5, 0x0, 0x7, 0x1, 0x4, 0x6, 0xfc, 0x3, 0x6, 0x7, 0x401, 0x7fffffff, 0x81, 0x3, 0x9, 0x5f, 0xa12, 0x0, 0x6, 0x4680, 0x5, 0x6, 0x6, 0x6, 0x3ecd, 0x841e, 0x100, 0xffffffff, 0x80000000, 0xfffffff9, 0x800, 0x7, 0x2, 0x0, 0x48e, 0x0, 0x200, 0x0, 0x9, 0x7, 0x5, 0xfffffffc, 0x9, 0x5, 0x1, 0x1, 0x17, 0x45d1, 0x1000000, 0x5, 0x7fffffff, 0x1, 0x72, 0x7, 0x0, 0x3a1, 0x5a2480e5, 0x5, 0x1, 0x5, 0x7fffffff, 0xffffffff, 0x5, 0xbf, 0x8000, 0x9, 0x9000, 0xf311, 0x400, 0xffffffe1, 0x8b21, 0x3, 0x8000, 0x0, 0x9, 0x63, 0x6, 0x7, 0x7fff, 0x0, 0x7, 0x2, 0xd0, 0x5, 0xffff, 0x46, 0x800, 0x5, 0x6, 0xbf1, 0x6, 0x3, 0x1, 0x2, 0x45, 0x0, 0x0, 0x547, 0xfffffffd, 0x9, 0x0, 0x3, 0xffffffff, 0x101, 0x3f, 0x9, 0x6, 0x4b, 0x2, 0x101, 0x9, 0x80, 0xfff, 0x8000, 0x5, 0x5, 0xffffffff, 0x0, 0xae8, 0x2, 0x6, 0x4, 0x0, 0x6, 0xe39, 0xbf9, 0xd17, 0xfffff001, 0x8c55, 0x81, 0x800, 0x9, 0x1000, 0xfffffffa, 0x7, 0x20000000, 0x9, 0x5, 0x3, 0x8001, 0x3, 0x9, 0x5, 0x1f, 0x0, 0x10000, 0x2, 0x1000, 0x0, 0x38000, 0x0, 0x7f, 0x6, 0xfff, 0x3f, 0x3, 0x0, 0x1, 0x74f7f541, 0x8001, 0x5, 0x0, 0x8, 0x9, 0x400, 0x100, 0x80000000, 0x6, 0x5, 0x3, 0x2, 0x2, 0x6, 0x8, 0x6, 0x8000, 0x1, 0x8, 0x1ff, 0x6, 0xfffffff9, 0xfffffff7, 0x1f, 0xfff, 0x7, 0x4, 0x5, 0x9, 0xfffffff9, 0x9, 0x1, 0x5, 0x5, 0x6, 0x2ef, 0x1, 0x3, 0x1, 0x4, 0x27e7, 0x6, 0x99d0, 0x7e1, 0x5, 0x4222, 0x10000, 0x4ab6, 0x2, 0x45f, 0x81, 0x6, 0x100, 0xff, 0x9, 0x2, 0x8, 0x4, 0x0, 0x6, 0x1ff, 0xff, 0x2, 0x81, 0x1, 0xfffffff9, 0x99, 0xfffffffa, 0x3, 0x8, 0x1ff, 0x401, 0x8], 0x5, [{[0x2, 0x81], @private=0xa010102}, {[0x9, 0x7], @dev={0xac, 0x14, 0x14, 0x20}}, {[0xffff0001, 0x7fff], @multicast1}, {[0x80000000, 0x6], @broadcast}, {[0x0, 0x9], @broadcast}]}}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x12, 0xff, {0x100}}}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}], @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}, {0x3, 0x65, 0x4, 'bridge_slave_0\x00', 'geneve0\x00', 'netdevsim0\x00', 'vlan1\x00', @random="0f083534cf61", [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x9e, 0xd6, [], [@common=@AUDIT={'AUDIT\x00', 0x8}], @common=@mark={'mark\x00', 0x10, {{0xffffffe0, 0xfffffffffffffffd}}}}]}]}, 0xcca)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000001840)={&(0x7f0000001680), 0xc, &(0x7f0000001800)={&(0x7f0000001780)={0x44, 0x0, 0x800, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_PID={0x8}, @NL802154_ATTR_PID={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8804}, 0x4001)

18:00:45 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r3, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r5 = pidfd_getfd(r3, r3, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
r8 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r9 = openat$cgroup_ro(r3, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r10=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000ac0)={<r11=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r4, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8, 0x1, r3}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r10}, {0x8, 0x1, r11}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x2c, r2, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}]}, 0x2c}}, 0x850)
openat$cgroup_subtree(r5, &(0x7f0000000d40), 0x2, 0x0)
ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f0000000d80)={{0x2, 0x4e20, @multicast1}, {0x6, @random="2ac8a2d76271"}, 0x0, {0x2, 0x4e21, @rand_addr=0x64010100}, 'ip6erspan0\x00'})
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000013c0)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001380)={&(0x7f0000001280)={0xf4, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8, 0x1, r11}, {0x8, 0x1, r5}, {0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4da}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r5}, {0x8, 0x1, r11}, {0x8}, {0x8}, {0x8, 0x1, r10}, {0x8, 0x1, r7}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc}]}, 0xf4}, 0x1, 0x0, 0x0, 0x80}, 0x408b0)

18:00:45 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:00:45 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
r5 = syz_open_dev$vcsn(&(0x7f0000000540), 0x6, 0x0)
r6 = shmget(0x1, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil)
shmat(r6, &(0x7f0000ffc000/0x3000)=nil, 0x5800)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), r5)
sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x20000008}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x3c, r8, 0xb00, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x400}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x200}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000802}, 0x1)

18:00:45 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
r5 = syz_open_dev$vcsn(&(0x7f0000000540), 0x6, 0x0)
r6 = shmget(0x1, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil)
shmat(r6, &(0x7f0000ffc000/0x3000)=nil, 0x5800)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$batadv(&(0x7f00000005c0), r5)

18:00:45 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000600))

18:00:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
syz_open_dev$vcsn(&(0x7f0000000540), 0x6, 0x0)
r5 = shmget(0x1, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil)
shmat(r5, &(0x7f0000ffc000/0x3000)=nil, 0x5800)
socket$nl_generic(0x10, 0x3, 0x10)

18:00:46 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r3, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r5 = pidfd_getfd(r3, r3, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
r8 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r9 = openat$cgroup_ro(r3, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r10=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000ac0)={<r11=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r4, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8, 0x1, r3}, {0x8, 0x1, r7}, {0x8, 0x1, r8}, {0x8, 0x1, r9}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r10}, {0x8, 0x1, r11}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x2c, r2, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}]}, 0x2c}}, 0x850)
openat$cgroup_subtree(r5, &(0x7f0000000d40), 0x2, 0x0)
ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f0000000d80)={{0x2, 0x4e20, @multicast1}, {0x6, @random="2ac8a2d76271"}, 0x0, {0x2, 0x4e21, @rand_addr=0x64010100}, 'ip6erspan0\x00'})
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000013c0)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001380)={&(0x7f0000001280)={0xf4, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r6}, {0x8}, {0x8}, {0x8, 0x1, r11}, {0x8, 0x1, r5}, {0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8, 0x1, r6}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4da}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r5}, {0x8, 0x1, r11}, {0x8}, {0x8}, {0x8, 0x1, r10}, {0x8, 0x1, r7}, {0x8}]}, @NBD_ATTR_SERVER_FLAGS={0xc}]}, 0xf4}, 0x1, 0x0, 0x0, 0x80}, 0x408b0)

18:00:46 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
socketpair(0x26, 0xa, 0xfff, &(0x7f0000000a40)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDELRT(r7, 0x890c, &(0x7f0000000ac0)={0x0, {0x2, 0x4e24, @rand_addr=0x64010100}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x3f, &(0x7f0000000a80)='veth0_to_batadv\x00', 0x5, 0x8001, 0x3})
recvfrom(r7, &(0x7f0000000b40)=""/191, 0xbf, 0x10000, &(0x7f0000000c00)=@nl=@kern={0x10, 0x0, 0x0, 0x1}, 0x80)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000cc0), r5)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, r8, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000e00))

18:00:46 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000600))

18:00:46 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r9, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000001600)=@filter={'filter\x00', 0xe, 0x3, 0xc52, [0x0, 0x20000980, 0x200009b0, 0x20000a9e], 0x0, &(0x7f0000000940), &(0x7f0000000980)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x11, 0x1, 0x8, 'wg2\x00', 'dummy0\x00', 'veth1_to_bond\x00', 'team_slave_1\x00', @random="6982dfaa4ba6", [0x0, 0x59426bcf115b84b4, 0x0, 0xff], @multicast, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x6e, 0xbe, [], [], @common=@log={'log\x00', 0x28, {{0x6, "f43e771caaacac8c023829ffbe53f68ed05d958bcbb4857287f00cb02222", 0x8}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{0x11, 0x8, 0x22f0, 'lo\x00', 'veth1_virt_wifi\x00', 'ipvlan1\x00', 'veth1_vlan\x00', @broadcast, [0x0, 0x0, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x956, 0x9ce, 0x9fe, [@helper={{'helper\x00', 0x0, 0x28}, {{0x0, 'syz1\x00'}}}, @among={{'among\x00', 0x0, 0x870}, {{@offset, @zero, 0x3, {[0x8, 0x1, 0x6, 0x3, 0x0, 0x6, 0x9a, 0xa7, 0xfff, 0x9, 0x2, 0xfffffffe, 0x1, 0x0, 0x93a, 0xff, 0x8, 0x4, 0x5c0e, 0x8, 0x1, 0x9, 0x20, 0x1, 0x7, 0x101, 0x0, 0x8, 0x401, 0x3ff, 0xffffffff, 0xed37, 0x3, 0xffffffff, 0xfa46, 0x7, 0x8, 0xe10, 0x7, 0x10001, 0x7fffffff, 0x1, 0x4, 0x2, 0x0, 0x40, 0x6, 0x7, 0x9, 0x1f, 0x10001, 0x6, 0x1ff, 0x7, 0x40, 0x64, 0x1000, 0x9, 0x5d01, 0x10001, 0x0, 0x6, 0x7, 0x10001, 0x5, 0x9, 0x7, 0x10000, 0x5, 0x10000, 0x10001, 0x9, 0x4, 0x7fffffff, 0x4, 0x1, 0x9, 0x93ec, 0x8, 0x2, 0x0, 0x401, 0x5, 0x10000, 0x1000, 0xef8, 0x2, 0x0, 0x6, 0x66, 0x3, 0x3ff, 0x5, 0x80000000, 0xb0e9, 0x1, 0x0, 0x8, 0x8, 0x0, 0x5, 0x7fff, 0x1000, 0x9, 0x4, 0x1, 0xd8, 0x97e5, 0x7, 0x0, 0xff, 0x7fffffff, 0x8, 0x401, 0x7, 0x8001, 0x0, 0x0, 0x80000001, 0x81, 0x2, 0x6, 0x6, 0x7, 0x0, 0xfff, 0x6, 0x0, 0x6, 0xfff, 0xc6c6, 0x401, 0xd2f, 0x8, 0x8, 0x80000000, 0x8, 0x6, 0x5, 0x401, 0x40, 0x80, 0x3ff, 0x2c, 0x4, 0x520, 0x0, 0x4, 0x3, 0x0, 0xb6, 0x9, 0x2, 0x0, 0x9, 0x0, 0x5, 0x7f, 0x10000, 0xfffffffd, 0x5a2c, 0x3ff, 0x2bbc, 0x200, 0x8001, 0x7f, 0x7, 0x5e9c, 0x0, 0x3, 0x800, 0xffffffff, 0x7, 0x89, 0xffff, 0x866, 0x9, 0x8, 0x5, 0x8001, 0x8, 0x2, 0x1000, 0x1000, 0x6, 0x400, 0x6, 0x8001, 0x8, 0x4, 0x7, 0xff, 0xcd, 0x6, 0x8001, 0xffff, 0x7, 0x80000001, 0x5, 0x3ff, 0x4, 0x101, 0xfffffffe, 0x8, 0x2c, 0x9, 0x2, 0x100, 0x7, 0x7, 0x1, 0x9, 0x2b1c, 0xff, 0x3, 0x6, 0x9, 0x4, 0xe7ad, 0x2, 0x1000, 0x4, 0x5, 0x8, 0x5, 0xd70, 0xa1f, 0x80000000, 0x5, 0x1, 0x4, 0x4, 0x1, 0x6, 0x4, 0x7, 0x7, 0xffffffd3, 0x5, 0x800, 0x8, 0x58aa5d24, 0x5, 0x17f, 0x40, 0xfff, 0x7fff, 0xffffff81, 0xb1, 0x80, 0x7, 0x70df, 0x190, 0x96, 0xfffffff9, 0x6, 0x2], 0x2, [{[0x9, 0x3], @broadcast}, {[0x1ff, 0x3d55], @broadcast}]}, {[0x7, 0x40000000, 0x6, 0x6, 0x6, 0x4, 0xd0, 0x2, 0x5, 0x3, 0x5, 0xffff9c04, 0x7fffffff, 0x7fff, 0x1f, 0x0, 0x6, 0xfffffc00, 0x3100, 0x6, 0x1, 0x40, 0x3, 0x5, 0x9e60, 0x5, 0x0, 0x7, 0x1, 0x4, 0x6, 0xfc, 0x3, 0x6, 0x7, 0x401, 0x7fffffff, 0x81, 0x3, 0x9, 0x5f, 0xa12, 0x0, 0x6, 0x4680, 0x5, 0x6, 0x6, 0x6, 0x3ecd, 0x841e, 0x100, 0xffffffff, 0x80000000, 0xfffffff9, 0x800, 0x7, 0x2, 0x0, 0x48e, 0x0, 0x200, 0x0, 0x9, 0x7, 0x5, 0xfffffffc, 0x9, 0x5, 0x1, 0x1, 0x17, 0x45d1, 0x1000000, 0x5, 0x7fffffff, 0x1, 0x72, 0x7, 0x0, 0x3a1, 0x5a2480e5, 0x5, 0x1, 0x5, 0x7fffffff, 0xffffffff, 0x5, 0xbf, 0x8000, 0x9, 0x9000, 0xf311, 0x400, 0xffffffe1, 0x8b21, 0x3, 0x8000, 0x0, 0x9, 0x63, 0x6, 0x7, 0x7fff, 0x0, 0x7, 0x2, 0xd0, 0x5, 0xffff, 0x46, 0x800, 0x5, 0x6, 0xbf1, 0x6, 0x3, 0x1, 0x2, 0x45, 0x0, 0x0, 0x547, 0xfffffffd, 0x9, 0x0, 0x3, 0xffffffff, 0x101, 0x3f, 0x9, 0x6, 0x4b, 0x2, 0x101, 0x9, 0x80, 0xfff, 0x8000, 0x5, 0x5, 0xffffffff, 0x0, 0xae8, 0x2, 0x6, 0x4, 0x0, 0x6, 0xe39, 0xbf9, 0xd17, 0xfffff001, 0x8c55, 0x81, 0x800, 0x9, 0x1000, 0xfffffffa, 0x7, 0x20000000, 0x9, 0x5, 0x3, 0x8001, 0x3, 0x9, 0x5, 0x1f, 0x0, 0x10000, 0x2, 0x1000, 0x0, 0x38000, 0x0, 0x7f, 0x6, 0xfff, 0x3f, 0x3, 0x0, 0x1, 0x74f7f541, 0x8001, 0x5, 0x0, 0x8, 0x9, 0x400, 0x100, 0x80000000, 0x6, 0x5, 0x3, 0x2, 0x2, 0x6, 0x8, 0x6, 0x8000, 0x1, 0x8, 0x1ff, 0x6, 0xfffffff9, 0xfffffff7, 0x1f, 0xfff, 0x7, 0x4, 0x5, 0x9, 0xfffffff9, 0x9, 0x1, 0x5, 0x5, 0x6, 0x2ef, 0x1, 0x3, 0x1, 0x4, 0x27e7, 0x6, 0x99d0, 0x7e1, 0x5, 0x4222, 0x10000, 0x4ab6, 0x2, 0x45f, 0x81, 0x6, 0x100, 0xff, 0x9, 0x2, 0x8, 0x4, 0x0, 0x6, 0x1ff, 0xff, 0x2, 0x81, 0x1, 0xfffffff9, 0x99, 0xfffffffa, 0x3, 0x8, 0x1ff, 0x401, 0x8], 0x5, [{[0x2, 0x81], @private=0xa010102}, {[0x9, 0x7], @dev={0xac, 0x14, 0x14, 0x20}}, {[0xffff0001, 0x7fff], @multicast1}, {[0x80000000, 0x6], @broadcast}, {[0x0, 0x9], @broadcast}]}}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x12, 0xff, {0x100}}}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}], @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}, {0x3, 0x65, 0x4, 'bridge_slave_0\x00', 'geneve0\x00', 'netdevsim0\x00', 'vlan1\x00', @random="0f083534cf61", [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x9e, 0xd6, [], [@common=@AUDIT={'AUDIT\x00', 0x8}], @common=@mark={'mark\x00', 0x10, {{0xffffffe0, 0xfffffffffffffffd}}}}]}]}, 0xcca)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000001840)={&(0x7f0000001680), 0xc, &(0x7f0000001800)={&(0x7f0000001780)={0x44, 0x0, 0x800, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_PID={0x8}, @NL802154_ATTR_PID={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8804}, 0x4001)

18:00:46 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:00:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
syz_open_dev$vcsn(&(0x7f0000000540), 0x6, 0x0)
r5 = shmget(0x1, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil)
shmat(r5, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:00:46 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000600))

[  124.343263] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  124.344388] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  124.349563] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  124.356046] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  124.357116] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  124.414759] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  124.427222] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  124.437349] Bluetooth: hci7: Opcode 0x0c1a failed: -4
18:00:46 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x54, r5, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40040e0}, 0x1)
r6 = pidfd_getfd(0xffffffffffffffff, r4, 0x0)
mknodat$loop(r6, &(0x7f0000000580)='./file0\x00', 0x1, 0x1)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)
ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(r7, 0x80083314, &(0x7f0000000600))

18:00:46 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)
r7 = pidfd_getfd(r1, r4, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r7, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffff01}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xd01c}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x40}}, 0x4040001)
r8 = openat$cgroup_ro(r4, &(0x7f0000000800)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0)
sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r8, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x24, 0x0, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1f818ffbf8c06591}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x22}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x40040)

18:00:46 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r3, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r5 = pidfd_getfd(r3, r3, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r8 = openat$cgroup_ro(r3, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r9=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000ac0)={<r10=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r4, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8, 0x1, r3}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r9}, {0x8, 0x1, r10}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x2c, r2, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}]}, 0x2c}}, 0x850)
openat$cgroup_subtree(r5, &(0x7f0000000d40), 0x2, 0x0)
ioctl$sock_inet_SIOCSARP(r6, 0x8955, &(0x7f0000000d80)={{0x2, 0x4e20, @multicast1}, {0x6, @random="2ac8a2d76271"}, 0x0, {0x2, 0x4e21, @rand_addr=0x64010100}, 'ip6erspan0\x00'})

18:00:46 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
syz_open_dev$vcsn(&(0x7f0000000540), 0x6, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:00:46 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

[  125.379951] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  125.387663] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  125.388816] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  125.389929] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  125.391029] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  125.392728] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  125.394756] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  125.395866] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  126.649523] Bluetooth: hci0: command 0x0c1a tx timeout
[  127.417595] Bluetooth: hci7: command 0x0c1a tx timeout
[  127.418644] Bluetooth: hci6: command 0x0c1a tx timeout
[  127.419605] Bluetooth: hci5: command 0x0c1a tx timeout
[  127.420477] Bluetooth: hci4: command 0x0c1a tx timeout
[  127.420556] Bluetooth: hci3: command 0x0c1a tx timeout
[  127.421303] Bluetooth: hci2: command 0x0c1a tx timeout
[  127.422514] Bluetooth: hci1: command 0x0c1a tx timeout
18:00:55 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = pidfd_getfd(0xffffffffffffffff, r3, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000540)={{0xffffffffffffffff, 0x2, 0x9, 0x2, 0xfffffffe}})
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:00:55 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)

18:00:55 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r9, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)
setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000001600)=@filter={'filter\x00', 0xe, 0x3, 0xc52, [0x0, 0x20000980, 0x200009b0, 0x20000a9e], 0x0, &(0x7f0000000940), &(0x7f0000000980)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x11, 0x1, 0x8, 'wg2\x00', 'dummy0\x00', 'veth1_to_bond\x00', 'team_slave_1\x00', @random="6982dfaa4ba6", [0x0, 0x59426bcf115b84b4, 0x0, 0xff], @multicast, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x6e, 0xbe, [], [], @common=@log={'log\x00', 0x28, {{0x6, "f43e771caaacac8c023829ffbe53f68ed05d958bcbb4857287f00cb02222", 0x8}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{0x11, 0x8, 0x22f0, 'lo\x00', 'veth1_virt_wifi\x00', 'ipvlan1\x00', 'veth1_vlan\x00', @broadcast, [0x0, 0x0, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x956, 0x9ce, 0x9fe, [@helper={{'helper\x00', 0x0, 0x28}, {{0x0, 'syz1\x00'}}}, @among={{'among\x00', 0x0, 0x870}, {{@offset, @zero, 0x3, {[0x8, 0x1, 0x6, 0x3, 0x0, 0x6, 0x9a, 0xa7, 0xfff, 0x9, 0x2, 0xfffffffe, 0x1, 0x0, 0x93a, 0xff, 0x8, 0x4, 0x5c0e, 0x8, 0x1, 0x9, 0x20, 0x1, 0x7, 0x101, 0x0, 0x8, 0x401, 0x3ff, 0xffffffff, 0xed37, 0x3, 0xffffffff, 0xfa46, 0x7, 0x8, 0xe10, 0x7, 0x10001, 0x7fffffff, 0x1, 0x4, 0x2, 0x0, 0x40, 0x6, 0x7, 0x9, 0x1f, 0x10001, 0x6, 0x1ff, 0x7, 0x40, 0x64, 0x1000, 0x9, 0x5d01, 0x10001, 0x0, 0x6, 0x7, 0x10001, 0x5, 0x9, 0x7, 0x10000, 0x5, 0x10000, 0x10001, 0x9, 0x4, 0x7fffffff, 0x4, 0x1, 0x9, 0x93ec, 0x8, 0x2, 0x0, 0x401, 0x5, 0x10000, 0x1000, 0xef8, 0x2, 0x0, 0x6, 0x66, 0x3, 0x3ff, 0x5, 0x80000000, 0xb0e9, 0x1, 0x0, 0x8, 0x8, 0x0, 0x5, 0x7fff, 0x1000, 0x9, 0x4, 0x1, 0xd8, 0x97e5, 0x7, 0x0, 0xff, 0x7fffffff, 0x8, 0x401, 0x7, 0x8001, 0x0, 0x0, 0x80000001, 0x81, 0x2, 0x6, 0x6, 0x7, 0x0, 0xfff, 0x6, 0x0, 0x6, 0xfff, 0xc6c6, 0x401, 0xd2f, 0x8, 0x8, 0x80000000, 0x8, 0x6, 0x5, 0x401, 0x40, 0x80, 0x3ff, 0x2c, 0x4, 0x520, 0x0, 0x4, 0x3, 0x0, 0xb6, 0x9, 0x2, 0x0, 0x9, 0x0, 0x5, 0x7f, 0x10000, 0xfffffffd, 0x5a2c, 0x3ff, 0x2bbc, 0x200, 0x8001, 0x7f, 0x7, 0x5e9c, 0x0, 0x3, 0x800, 0xffffffff, 0x7, 0x89, 0xffff, 0x866, 0x9, 0x8, 0x5, 0x8001, 0x8, 0x2, 0x1000, 0x1000, 0x6, 0x400, 0x6, 0x8001, 0x8, 0x4, 0x7, 0xff, 0xcd, 0x6, 0x8001, 0xffff, 0x7, 0x80000001, 0x5, 0x3ff, 0x4, 0x101, 0xfffffffe, 0x8, 0x2c, 0x9, 0x2, 0x100, 0x7, 0x7, 0x1, 0x9, 0x2b1c, 0xff, 0x3, 0x6, 0x9, 0x4, 0xe7ad, 0x2, 0x1000, 0x4, 0x5, 0x8, 0x5, 0xd70, 0xa1f, 0x80000000, 0x5, 0x1, 0x4, 0x4, 0x1, 0x6, 0x4, 0x7, 0x7, 0xffffffd3, 0x5, 0x800, 0x8, 0x58aa5d24, 0x5, 0x17f, 0x40, 0xfff, 0x7fff, 0xffffff81, 0xb1, 0x80, 0x7, 0x70df, 0x190, 0x96, 0xfffffff9, 0x6, 0x2], 0x2, [{[0x9, 0x3], @broadcast}, {[0x1ff, 0x3d55], @broadcast}]}, {[0x7, 0x40000000, 0x6, 0x6, 0x6, 0x4, 0xd0, 0x2, 0x5, 0x3, 0x5, 0xffff9c04, 0x7fffffff, 0x7fff, 0x1f, 0x0, 0x6, 0xfffffc00, 0x3100, 0x6, 0x1, 0x40, 0x3, 0x5, 0x9e60, 0x5, 0x0, 0x7, 0x1, 0x4, 0x6, 0xfc, 0x3, 0x6, 0x7, 0x401, 0x7fffffff, 0x81, 0x3, 0x9, 0x5f, 0xa12, 0x0, 0x6, 0x4680, 0x5, 0x6, 0x6, 0x6, 0x3ecd, 0x841e, 0x100, 0xffffffff, 0x80000000, 0xfffffff9, 0x800, 0x7, 0x2, 0x0, 0x48e, 0x0, 0x200, 0x0, 0x9, 0x7, 0x5, 0xfffffffc, 0x9, 0x5, 0x1, 0x1, 0x17, 0x45d1, 0x1000000, 0x5, 0x7fffffff, 0x1, 0x72, 0x7, 0x0, 0x3a1, 0x5a2480e5, 0x5, 0x1, 0x5, 0x7fffffff, 0xffffffff, 0x5, 0xbf, 0x8000, 0x9, 0x9000, 0xf311, 0x400, 0xffffffe1, 0x8b21, 0x3, 0x8000, 0x0, 0x9, 0x63, 0x6, 0x7, 0x7fff, 0x0, 0x7, 0x2, 0xd0, 0x5, 0xffff, 0x46, 0x800, 0x5, 0x6, 0xbf1, 0x6, 0x3, 0x1, 0x2, 0x45, 0x0, 0x0, 0x547, 0xfffffffd, 0x9, 0x0, 0x3, 0xffffffff, 0x101, 0x3f, 0x9, 0x6, 0x4b, 0x2, 0x101, 0x9, 0x80, 0xfff, 0x8000, 0x5, 0x5, 0xffffffff, 0x0, 0xae8, 0x2, 0x6, 0x4, 0x0, 0x6, 0xe39, 0xbf9, 0xd17, 0xfffff001, 0x8c55, 0x81, 0x800, 0x9, 0x1000, 0xfffffffa, 0x7, 0x20000000, 0x9, 0x5, 0x3, 0x8001, 0x3, 0x9, 0x5, 0x1f, 0x0, 0x10000, 0x2, 0x1000, 0x0, 0x38000, 0x0, 0x7f, 0x6, 0xfff, 0x3f, 0x3, 0x0, 0x1, 0x74f7f541, 0x8001, 0x5, 0x0, 0x8, 0x9, 0x400, 0x100, 0x80000000, 0x6, 0x5, 0x3, 0x2, 0x2, 0x6, 0x8, 0x6, 0x8000, 0x1, 0x8, 0x1ff, 0x6, 0xfffffff9, 0xfffffff7, 0x1f, 0xfff, 0x7, 0x4, 0x5, 0x9, 0xfffffff9, 0x9, 0x1, 0x5, 0x5, 0x6, 0x2ef, 0x1, 0x3, 0x1, 0x4, 0x27e7, 0x6, 0x99d0, 0x7e1, 0x5, 0x4222, 0x10000, 0x4ab6, 0x2, 0x45f, 0x81, 0x6, 0x100, 0xff, 0x9, 0x2, 0x8, 0x4, 0x0, 0x6, 0x1ff, 0xff, 0x2, 0x81, 0x1, 0xfffffff9, 0x99, 0xfffffffa, 0x3, 0x8, 0x1ff, 0x401, 0x8], 0x5, [{[0x2, 0x81], @private=0xa010102}, {[0x9, 0x7], @dev={0xac, 0x14, 0x14, 0x20}}, {[0xffff0001, 0x7fff], @multicast1}, {[0x80000000, 0x6], @broadcast}, {[0x0, 0x9], @broadcast}]}}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x12, 0xff, {0x100}}}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}], @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}, {0x3, 0x65, 0x4, 'bridge_slave_0\x00', 'geneve0\x00', 'netdevsim0\x00', 'vlan1\x00', @random="0f083534cf61", [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0x6e, 0x9e, 0xd6, [], [@common=@AUDIT={'AUDIT\x00', 0x8}], @common=@mark={'mark\x00', 0x10, {{0xffffffe0, 0xfffffffffffffffd}}}}]}]}, 0xcca)

18:00:55 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x54, r5, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40040e0}, 0x1)
r6 = pidfd_getfd(0xffffffffffffffff, r4, 0x0)
mknodat$loop(r6, &(0x7f0000000580)='./file0\x00', 0x1, 0x1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:00:55 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)
r7 = pidfd_getfd(r1, r4, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r7, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffff01}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xd01c}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x40}}, 0x4040001)
openat$cgroup_ro(r4, &(0x7f0000000800)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0)

18:00:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000500)='devices.allow\x00', 0x2, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:00:55 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
socketpair(0x26, 0xa, 0xfff, &(0x7f0000000a40)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDELRT(r7, 0x890c, &(0x7f0000000ac0)={0x0, {0x2, 0x4e24, @rand_addr=0x64010100}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x3f, &(0x7f0000000a80)='veth0_to_batadv\x00', 0x5, 0x8001, 0x3})
recvfrom(r7, &(0x7f0000000b40)=""/191, 0xbf, 0x10000, &(0x7f0000000c00)=@nl=@kern={0x10, 0x0, 0x0, 0x1}, 0x80)
r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000cc0), r5)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, r8, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:00:55 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r3, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r5 = pidfd_getfd(r3, r3, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r8 = openat$cgroup_ro(r3, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r9=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000ac0)={<r10=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r4, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8, 0x1, r3}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r9}, {0x8, 0x1, r10}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x2c, r2, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}]}, 0x2c}}, 0x850)
openat$cgroup_subtree(r5, &(0x7f0000000d40), 0x2, 0x0)

18:00:55 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
pidfd_getfd(0xffffffffffffffff, r3, 0x0)
r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:00:55 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
memfd_create(&(0x7f00000004c0)='./binderfs2/custom0\x00', 0x1)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:00:56 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r9, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:00:56 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, r4, 0x400, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8001}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8004}, 0x20000000)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:00:56 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
pidfd_getfd(0xffffffffffffffff, r3, 0x0)
r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

[  134.523080] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  134.524065] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  134.525405] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  134.526369] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  134.527549] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  134.528856] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  134.530082] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  134.531027] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  135.738486] Bluetooth: hci0: command 0x0c1a tx timeout
[  136.570584] Bluetooth: hci7: command 0x0c1a tx timeout
[  136.571008] Bluetooth: hci6: command 0x0c1a tx timeout
[  136.572173] Bluetooth: hci5: command 0x0c1a tx timeout
[  136.572718] Bluetooth: hci4: command 0x0c1a tx timeout
[  136.574310] Bluetooth: hci3: command 0x0c1a tx timeout
[  136.574481] Bluetooth: hci2: command 0x0c1a tx timeout
[  136.575115] Bluetooth: hci1: command 0x0c1a tx timeout
18:01:05 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x54, r5, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40040e0}, 0x1)
pidfd_getfd(0xffffffffffffffff, r4, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:01:05 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)
r7 = pidfd_getfd(r1, r4, 0x0)
sendmsg$BATADV_CMD_SET_VLAN(r7, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x40, r6, 0x400, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xffffff01}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xd01c}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x40}}, 0x4040001)

18:01:05 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)

18:01:05 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r2)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:05 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
pidfd_getfd(0xffffffffffffffff, r3, 0x0)
r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:05 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r3, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r5 = pidfd_getfd(r3, r3, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r8 = openat$cgroup_ro(r3, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r9=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000ac0)={<r10=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r4, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r5}, {0x8}, {0x8}, {0x8, 0x1, r3}, {0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x1, r8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r3}, {0x8, 0x1, r9}, {0x8, 0x1, r10}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x2c, r2, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}]}, 0x2c}}, 0x850)

18:01:05 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
socketpair(0x26, 0xa, 0xfff, &(0x7f0000000a40)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDELRT(r7, 0x890c, &(0x7f0000000ac0)={0x0, {0x2, 0x4e24, @rand_addr=0x64010100}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x3f, &(0x7f0000000a80)='veth0_to_batadv\x00', 0x5, 0x8001, 0x3})
recvfrom(r7, &(0x7f0000000b40)=""/191, 0xbf, 0x10000, &(0x7f0000000c00)=@nl=@kern={0x10, 0x0, 0x0, 0x1}, 0x80)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:05 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:05 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:05 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
openat$cgroup_ro(r2, &(0x7f0000000300)='freezer.state\x00', 0x0, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:06 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
socketpair(0x26, 0xa, 0xfff, &(0x7f0000000a40)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDELRT(r7, 0x890c, &(0x7f0000000ac0)={0x0, {0x2, 0x4e24, @rand_addr=0x64010100}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x3f, &(0x7f0000000a80)='veth0_to_batadv\x00', 0x5, 0x8001, 0x3})
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:06 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f00000004c0)={{0x2e, @rand_addr=0x64010102, 0x4e22, 0x2, 'lc\x00', 0x0, 0x7fffffff, 0x14}, {@local, 0x4e24, 0x1, 0xb1fa000, 0x1ff, 0xfff}}, 0x44)
r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:06 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:06 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
r2 = syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f00000002c0)={0x1})
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:06 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r4 = pidfd_getfd(r2, r2, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r7 = openat$cgroup_ro(r2, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r8=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000ac0)={<r9=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r8}, {0x8, 0x1, r9}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:06 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)

[  144.393140] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  144.402571] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  144.409787] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  144.412878] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  144.418086] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  144.425372] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  144.448008] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  144.453886] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  145.593576] Bluetooth: hci0: command 0x0c1a tx timeout
[  146.425614] Bluetooth: hci4: command 0x0c1a tx timeout
[  146.426778] Bluetooth: hci3: command 0x0c1a tx timeout
[  146.427792] Bluetooth: hci2: command 0x0c1a tx timeout
[  146.428805] Bluetooth: hci1: command 0x0c1a tx timeout
[  146.489530] Bluetooth: hci7: command 0x0c1a tx timeout
[  146.490635] Bluetooth: hci6: command 0x0c1a tx timeout
[  146.491670] Bluetooth: hci5: command 0x0c1a tx timeout
18:01:14 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:14 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
socketpair(0x26, 0xa, 0xfff, &(0x7f0000000a40))
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:14 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:14 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x54, r5, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xd3}]}, 0x54}, 0x1, 0x0, 0x0, 0x40040e0}, 0x1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:01:14 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r4 = pidfd_getfd(r2, r2, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r7 = openat$cgroup_ro(r2, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r8=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:14 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)
pidfd_getfd(r1, r4, 0x0)

18:01:14 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:14 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
syz_open_dev$vcsn(&(0x7f0000000280), 0x8000000000000000, 0x40140)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:14 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
r1 = syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x1, 0x6, 0x12, 0x10, "240b835718515adf167c3718ac4f8ed0a6214ed5fcda421c7fd725ccd3c332d5b9123627c243fc07ff4cbf2a75a61a01c7dec18568513b016c5d269a732cdd46", "64dd5b79463ad3321f18277e5ac42522bb17544ddb58eb3d56e47169b0cdd878", [0x4, 0xfffffffffffffff7]})
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:14 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:15 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:15 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
syz_open_dev$loop(&(0x7f0000000180), 0x6, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:15 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r8, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:15 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800)=<r6=>0x0, &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
tkill(r6, 0x0)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:15 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:15 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r4 = pidfd_getfd(r2, r2, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r7 = openat$cgroup_ro(r2, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:15 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000080))
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

[  153.343476] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  153.344675] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  153.346193] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  153.347287] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  153.352764] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  153.353871] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  153.363699] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  153.365849] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  154.554458] Bluetooth: hci0: command 0x0c1a tx timeout
[  155.387207] Bluetooth: hci7: command 0x0c1a tx timeout
[  155.387728] Bluetooth: hci6: command 0x0c1a tx timeout
[  155.388193] Bluetooth: hci5: command 0x0c1a tx timeout
[  155.388507] Bluetooth: hci4: command 0x0c1a tx timeout
[  155.388671] Bluetooth: hci3: command 0x0c1a tx timeout
[  155.389654] Bluetooth: hci2: command 0x0c1a tx timeout
[  155.390048] Bluetooth: hci1: command 0x0c1a tx timeout
18:01:23 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:01:23 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000480)=""/11)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:23 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), 0xffffffffffffffff)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:01:23 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r8, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:23 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x800, 0x1)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:23 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
r1 = clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r2=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500)=<r3=>0x0, {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r5 = pidfd_getfd(r2, r4, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
clone3(&(0x7f00000009c0)={0x10000000, &(0x7f00000007c0), &(0x7f0000000800), &(0x7f0000000840), {0x2d}, &(0x7f0000000880)=""/64, 0x40, &(0x7f00000008c0)=""/189, &(0x7f0000000980)=[r3, r1, r3, r3], 0x4, {r5}}, 0x58)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r5, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:23 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r4 = pidfd_getfd(r2, r2, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r7 = openat$cgroup_ro(r2, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:23 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:23 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:24 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x2010, 0xffffffffffffffff, 0x10000000)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:24 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:24 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x40, r7, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7ff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2b75}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf639}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x880)
r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r8, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

[  162.536481] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  162.538251] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  162.539270] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  162.540910] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  162.542047] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  162.543222] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  162.545030] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  162.546088] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  163.770486] Bluetooth: hci0: command 0x0c1a tx timeout
[  164.602552] Bluetooth: hci7: command 0x0c1a tx timeout
[  164.603186] Bluetooth: hci6: command 0x0c1a tx timeout
[  164.603783] Bluetooth: hci5: command 0x0c1a tx timeout
[  164.604341] Bluetooth: hci4: command 0x0c1a tx timeout
[  164.604937] Bluetooth: hci3: command 0x0c1a tx timeout
[  164.605512] Bluetooth: hci2: command 0x0c1a tx timeout
[  164.605557] Bluetooth: hci1: command 0x0c1a tx timeout
18:01:33 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r1=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500), {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r3 = pidfd_getfd(r1, r2, 0x0)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:33 executing program 0:
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x5)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:33 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:01:33 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:01:33 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x4e22, @multicast1}, 0x10)
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:33 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:33 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r4 = pidfd_getfd(r2, r2, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
r7 = openat$cgroup_ro(r2, &(0x7f0000000980)='memory.current\x00', 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8, 0x1, r7}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:33 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
syz_genetlink_get_family_id$nbd(&(0x7f00000006c0), r2)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r7, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r8, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:33 executing program 0:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x1800, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:33 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:33 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x5800)

18:01:33 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480)=<r1=>0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000500), {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
r3 = pidfd_getfd(r1, r2, 0x0)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:33 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:33 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:33 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
sendmsg$NL802154_CMD_SET_LBT_MODE(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x1}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000000)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r7, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r8, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:33 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r4 = pidfd_getfd(r2, r2, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
r6 = syz_open_dev$vcsn(&(0x7f00000007c0), 0x2e, 0x408c00)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r7=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8, 0x1, r5}, {0x8, 0x1, r6}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r7}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

[  171.765932] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  171.767091] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  171.770874] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  171.772272] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  171.773037] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  171.773644] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  171.774201] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  171.774835] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  172.985565] Bluetooth: hci0: command 0x0c1a tx timeout
[  173.819415] Bluetooth: hci7: command 0x0c1a tx timeout
[  173.819667] Bluetooth: hci6: command 0x0c1a tx timeout
[  173.820460] Bluetooth: hci5: command 0x0c1a tx timeout
[  173.820494] Bluetooth: hci4: command 0x0c1a tx timeout
[  173.820508] Bluetooth: hci3: command 0x0c1a tx timeout
[  173.820522] Bluetooth: hci2: command 0x0c1a tx timeout
[  173.821278] Bluetooth: hci1: command 0x0c1a tx timeout
18:01:41 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
openat$urandom(0xffffffffffffff9c, &(0x7f0000000780), 0x40, 0x0)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:41 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000400)={0x5, 0x4, 0x7ff, 0x1, 0x0, 0x2})
socket$inet_tcp(0x2, 0x1, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:41 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:01:41 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:01:41 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r2)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r6, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r7, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:41 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:41 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r4 = pidfd_getfd(r2, r2, 0x0)
socketpair(0x2a, 0x6, 0x31, &(0x7f0000000780)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r6=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8, 0x1, r5}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r6}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:41 executing program 0:
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x0)

18:01:41 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='blkio.bfq.io_wait_time\x00', 0x0, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:41 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:41 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:01:41 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:42 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x4c, r5, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000814}, 0x24044080)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r6, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r7, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:42 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
clone3(&(0x7f0000000700)={0x9040480, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0x13}, &(0x7f0000000540)=""/252, 0xfc, &(0x7f0000000640)=""/119, &(0x7f00000006c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r0}}, 0x58)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:42 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:42 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
r4 = pidfd_getfd(r2, r2, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r5=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8, 0x1, r4}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r5}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:42 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, r2, 0x1)
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:42 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

[  180.485321] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  180.487041] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  180.488111] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  180.489676] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  180.490711] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  180.491748] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  180.493111] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  180.494197] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  181.690466] Bluetooth: hci0: command 0x0c1a tx timeout
[  182.523177] Bluetooth: hci7: command 0x0c1a tx timeout
[  182.523850] Bluetooth: hci6: command 0x0c1a tx timeout
[  182.524371] Bluetooth: hci5: command 0x0c1a tx timeout
[  182.524488] Bluetooth: hci4: command 0x0c1a tx timeout
[  182.524923] Bluetooth: hci3: command 0x0c1a tx timeout
[  182.525836] Bluetooth: hci2: command 0x0c1a tx timeout
[  182.526282] Bluetooth: hci1: command 0x0c1a tx timeout
18:01:50 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:01:50 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000340), 0x20000000, &(0x7f00000003c0))
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:50 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:01:50 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:50 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740), 0xffffffffffffffff)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r4=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r4}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:50 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:50 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), r4)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r5, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r6, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:50 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:01:50 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
r0 = syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x8)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:50 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:50 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:50 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
r2 = pidfd_getfd(r1, r0, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:50 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
syz_open_dev$loop(&(0x7f0000000300), 0x83f, 0x28800)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:50 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r3=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r3}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

[  189.249498] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  189.251290] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  189.252356] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  189.254658] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  189.256117] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  189.257828] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  189.259569] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  189.261270] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  190.457567] Bluetooth: hci0: command 0x0c1a tx timeout
[  191.289569] Bluetooth: hci7: command 0x0c1a tx timeout
[  191.290681] Bluetooth: hci6: command 0x0c1a tx timeout
[  191.291536] Bluetooth: hci5: command 0x0c1a tx timeout
[  191.291715] Bluetooth: hci4: command 0x0c1a tx timeout
[  191.292318] Bluetooth: hci3: command 0x0c1a tx timeout
[  191.293107] Bluetooth: hci2: command 0x0c1a tx timeout
[  191.293910] Bluetooth: hci1: command 0x0c1a tx timeout
18:01:59 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:01:59 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000002c0), 0x2, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:59 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:01:59 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:01:59 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:59 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:59 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r3=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r3}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:01:59 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
socket$inet_tcp(0x2, 0x1, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:01:59 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000001c0)=""/221)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:59 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000280))
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:59 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuacct.usage_percpu\x00', 0x0, 0x0)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, r1, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, r1, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:01:59 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
set_robust_list(&(0x7f0000000240)={0x0, 0x5}, 0x18)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:01:59 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:01:59 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:00 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r3=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r3}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:00 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
set_robust_list(&(0x7f0000000200)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x1f, &(0x7f00000001c0)}, 0x18)
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

[  198.247825] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  198.249125] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  198.252845] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  198.254145] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  198.255520] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  198.259234] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  198.261927] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  198.266587] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  199.418227] Bluetooth: hci0: command 0x0c1a tx timeout
[  200.314492] Bluetooth: hci7: command 0x0c1a tx timeout
[  200.314569] Bluetooth: hci6: command 0x0c1a tx timeout
[  200.315577] Bluetooth: hci5: command 0x0c1a tx timeout
[  200.316142] Bluetooth: hci4: command 0x0c1a tx timeout
[  200.317104] Bluetooth: hci3: command 0x0c1a tx timeout
[  200.317530] Bluetooth: hci2: command 0x0c1a tx timeout
[  200.318293] Bluetooth: hci1: command 0x0c1a tx timeout
18:02:07 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:07 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
socket$inet_tcp(0x2, 0x1, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:02:07 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r3=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r3}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:07 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:02:07 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
socket$nl_generic(0x10, 0x3, 0x10)

18:02:07 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/215)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:07 executing program 3:
ioctl$RNDADDENTROPY(0xffffffffffffffff, 0x40085203, &(0x7f0000000000)={0xb58, 0xfe, "b11c8a34b9df1f45f8b9ed06a0a152b1a049bb6e9d1ee392250614ea50b1a51f06e960780542f74315a0bd878f5037e7a2c07991b712f8278424bca3aa688c24c74dd5dbd645ebb412a0738d37df8f07d4eb4526517313a4199947145844b256f20abbf87847271916aa5c23855d2e1eea1d808ea31148ee5c4ae1b413c8308eb335ca5c877aa498e473478bdc4b8997c40909d4a6cd58a28ea236f44542b7dda4db5ea0a1523765456818f592afe36f694ea74a03a882fd840aa821230013273f6356b0d30b00457b1e357a3578c1cc551e83e582a1ca5404d0cdfd6fe3161d942f7bcdf5671c0ba7e1736d681f99f50b172e758c7d88c4c9390126463f"})
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:02:07 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:08 executing program 3:
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, 0x0, 0x10, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x40)

18:02:08 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
syz_open_dev$evdev(&(0x7f0000000040), 0x7, 0x80000)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:08 executing program 3:
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, 0x0, 0x40)

18:02:08 executing program 5:
ioctl$EVIOCGABS20(0xffffffffffffffff, 0x80184560, &(0x7f0000000000)=""/24)
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:08 executing program 3:
sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, 0x0, 0x0)

18:02:08 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:08 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r2=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:08 executing program 5:
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

[  206.671117] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  206.671854] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  206.673328] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  206.674011] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  206.675356] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  206.676323] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  206.677512] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  206.678122] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  207.866482] Bluetooth: hci0: command 0x0c1a tx timeout
[  208.697532] Bluetooth: hci1: command 0x0c1a tx timeout
[  208.698494] Bluetooth: hci7: command 0x0c1a tx timeout
[  208.698616] Bluetooth: hci6: command 0x0c1a tx timeout
[  208.699396] Bluetooth: hci5: command 0x0c1a tx timeout
[  208.700346] Bluetooth: hci4: command 0x0c1a tx timeout
[  208.701130] Bluetooth: hci3: command 0x0c1a tx timeout
[  208.702086] Bluetooth: hci2: command 0x0c1a tx timeout
18:02:17 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
socket$inet_tcp(0x2, 0x1, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:02:17 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
socket$nl_generic(0x10, 0x3, 0x10)

18:02:17 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:17 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:02:17 executing program 5:
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:17 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
pidfd_getfd(r1, r0, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:17 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:17 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r2=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:17 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r2=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:17 executing program 5:
perf_event_open$cgroup(&(0x7f0000000300)={0x4, 0x80, 0xea, 0x9, 0x71, 0x8, 0x0, 0x1f, 0x3d9c25c8b82a2f81, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x9, 0x0, @perf_config_ext={0x0, 0x1}, 0x10009, 0x2, 0x8001, 0x4, 0x2, 0xfffffffc, 0xfffb, 0x0, 0xfff, 0x0, 0x9}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:17 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x24}}, 0x40800)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r2=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:17 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:17 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:17 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r5, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:17 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:17 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

[  215.806393] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  215.808526] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  215.810609] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  215.811654] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  215.812756] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  215.813772] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  215.815692] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  215.817034] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  217.018482] Bluetooth: hci0: command 0x0c1a tx timeout
[  217.851775] Bluetooth: hci7: command 0x0c1a tx timeout
[  217.852263] Bluetooth: hci6: command 0x0c1a tx timeout
[  217.852551] Bluetooth: hci5: command 0x0c1a tx timeout
[  217.852745] Bluetooth: hci4: command 0x0c1a tx timeout
[  217.853712] Bluetooth: hci3: command 0x0c1a tx timeout
[  217.854101] Bluetooth: hci2: command 0x0c1a tx timeout
[  217.855043] Bluetooth: hci1: command 0x0c1a tx timeout
18:02:26 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:26 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
socket$nl_generic(0x10, 0x3, 0x10)

18:02:26 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:26 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r2=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:26 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)

18:02:26 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:02:26 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
recvfrom$inet(0xffffffffffffffff, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:02:26 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:27 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:27 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:27 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:02:27 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:27 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:02:27 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x3, 0xffffffffffffffff, 0x10001, 0x80000})
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

[  225.614161] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  225.615664] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  225.617127] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  225.618080] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  225.619406] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  225.620963] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  225.622220] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  225.623723] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  226.810485] Bluetooth: hci0: command 0x0c1a tx timeout
[  227.642462] Bluetooth: hci7: command 0x0c1a tx timeout
[  227.642541] Bluetooth: hci6: command 0x0c1a tx timeout
[  227.643014] Bluetooth: hci5: command 0x0c1a tx timeout
[  227.644106] Bluetooth: hci4: command 0x0c1a tx timeout
[  227.644504] Bluetooth: hci3: command 0x0c1a tx timeout
[  227.644525] Bluetooth: hci2: command 0x0c1a tx timeout
[  227.645720] Bluetooth: hci1: command 0x0c1a tx timeout
18:02:36 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:02:36 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:36 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:36 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:36 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:36 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:02:36 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
recvfrom$inet(0xffffffffffffffff, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:02:36 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:36 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x6, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}, {0x8, 0x0, 0x20, 0x800}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:36 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)

18:02:36 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:36 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)

18:02:36 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)

18:02:36 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:36 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:36 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x10001}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x20}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x850)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:37 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

[  235.208081] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  235.208948] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  235.209552] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  235.210136] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  235.210763] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  235.211319] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  235.211928] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  235.212555] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  236.410463] Bluetooth: hci0: command 0x0c1a tx timeout
[  237.241530] Bluetooth: hci7: command 0x0c1a tx timeout
[  237.242391] Bluetooth: hci6: command 0x0c1a tx timeout
[  237.243344] Bluetooth: hci5: command 0x0c1a tx timeout
[  237.243471] Bluetooth: hci4: command 0x0c1a tx timeout
[  237.244190] Bluetooth: hci3: command 0x0c1a tx timeout
[  237.245168] Bluetooth: hci2: command 0x0c1a tx timeout
[  237.245918] Bluetooth: hci1: command 0x0c1a tx timeout
18:02:46 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)

18:02:46 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:46 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:46 executing program 2:
r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4d}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004010)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r1)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r2=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:46 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:46 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000300), 0x4)
recvfrom$inet(0xffffffffffffffff, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:02:46 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:02:46 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
ioctl$SNAPSHOT_SET_SWAP_AREA(r4, 0x400c330d, &(0x7f0000000400)={0x100000000, 0x55fd0000})
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:46 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x0, 0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:46 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)

18:02:46 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x0, 0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:46 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r2)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:46 executing program 2:
syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r0)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:46 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
recvfrom(0xffffffffffffffff, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:02:46 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r2)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r2)

18:02:46 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x0, 0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:46 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000380), r0)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:47 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x5, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:47 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:47 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x5, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}, {0xff44, 0x1f, 0x3, 0x10001}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:47 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, r0)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

[  245.092843] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  245.093564] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  245.094137] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  245.095026] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  245.096462] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  245.097027] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  245.100879] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  245.108932] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  246.265537] Bluetooth: hci0: command 0x0c1a tx timeout
[  247.097603] Bluetooth: hci3: command 0x0c1a tx timeout
[  247.098773] Bluetooth: hci2: command 0x0c1a tx timeout
[  247.099799] Bluetooth: hci1: command 0x0c1a tx timeout
[  247.161558] Bluetooth: hci7: command 0x0c1a tx timeout
[  247.162727] Bluetooth: hci6: command 0x0c1a tx timeout
[  247.164038] Bluetooth: hci5: command 0x0c1a tx timeout
[  247.164486] Bluetooth: hci4: command 0x0c1a tx timeout
18:02:55 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:55 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r4, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:02:55 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), 0xffffffffffffffff)

18:02:55 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x214, 0x15, 0x10, 0x70bd2d, 0x25dfdbfe, {0x1, 0x5}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "a53a0d4c74d603af9bdb211a239471f482240297a6d1519fa2c289620fe8cf6609046d611edfc1eb0c42780c2d4230b5eb32f4aded948f778f8bb1301dedcda2c8e3b1ca1cc01efda21b0f1ee0b76151b52c8dedf5e0d57d1a13ad77eb7ea3a28e96792c80ae18a7613cd8e10b3055d825654387d86a2784bb"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "c02d4bfb1ab10ed53f0ad475508d84f9ee35e7b02d51d84c7a9c52fd4631feada5b2506c3ecdfeb87f17b80ff1c08fa5331e185c5805c4c0e21f69cfc828d835082b27f07481796c26648f7c46c8f89b99f1b0ecce5920343fcfe2b5875d0ef2c3f995a5bbd2fb8c0026f7caf71614ade9ceaffcbe1f38c2eb40d6cad4d4a0f175ca17ed9ac978b7c3fd5fcc45a4dd88212825bdda99099e92c8d423e699e8c47c5f7b65b3a80cccdfdc6c627b6f36af40d7348dbabcd3fa18f690126da478549070caf8c5"}, @INET_DIAG_REQ_BYTECODE={0x84, 0x1, "70a21932d5db02f18c62c3e99d3e88bd43e42342fca0a9814d46fc1468b4cb8c2f6af352f751f42ea3eefa96ba7a56e071f2023f70c4a28a8eefbae1caf98d88b0d0db45cfa59882aebc9b23f9c6e9837534fd6c5df8423fbd584d19ca947fdcdfbc301bd5b78336ba1efb09a34c08c7349fdb0b0b2a6954c6e92f219c0c6f50"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "bc2876ea278bb887757f39c5990469f63012b052b51ebc58975dd0b0030dea22b91853a42fab8cf422ce93"}]}, 0x214}, 0x1, 0x0, 0x0, 0x800}, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:55 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x4, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}, {0x200, 0x9, 0x1, 0x8a2}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:55 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:02:55 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
recvfrom(0xffffffffffffffff, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:02:55 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:02:55 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), 0xffffffffffffffff)

18:02:55 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), 0xffffffffffffffff)

18:02:55 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x240000c0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:02:55 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x3, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:02:56 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', <r1=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r3, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

[  254.440072] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  254.441484] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  254.442810] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  254.443994] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  254.445230] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  254.446553] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  254.447805] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  254.449009] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  255.609609] Bluetooth: hci0: command 0x0c1a tx timeout
[  256.506575] Bluetooth: hci7: command 0x0c1a tx timeout
[  256.507648] Bluetooth: hci6: command 0x0c1a tx timeout
[  256.508634] Bluetooth: hci5: command 0x0c1a tx timeout
[  256.509613] Bluetooth: hci4: command 0x0c1a tx timeout
[  256.510455] Bluetooth: hci3: command 0x0c1a tx timeout
[  256.510629] Bluetooth: hci2: command 0x0c1a tx timeout
[  256.511167] Bluetooth: hci1: command 0x0c1a tx timeout
18:03:03 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000009c0)={<r1=>0xffffffffffffffff})
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:03 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00'})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00'})
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:03 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000280)='cpuacct.usage_sys\x00', 0x0, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r3, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:03:03 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:03 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x3, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}, {0x1, 0x2, 0x0, 0x10000}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:03 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00'})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00'})
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:03 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:03 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
recvfrom(0xffffffffffffffff, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:03 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x2, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}, {0x20, 0x65, 0x7, 0x9}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:04 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:04 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00'})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00'})
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:04 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:04 executing program 4:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00'})
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:04 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74, 0x1, 0x7, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:04 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00'})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00'})
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:04 executing program 2:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:04 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:04 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r1)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r1)

[  262.560858] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  262.561620] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  262.562173] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  262.562881] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  262.563514] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  262.564094] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  262.564828] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  262.565385] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  263.737641] Bluetooth: hci0: command 0x0c1a tx timeout
[  264.569522] Bluetooth: hci7: command 0x0c1a tx timeout
[  264.570465] Bluetooth: hci6: command 0x0c1a tx timeout
[  264.570615] Bluetooth: hci5: command 0x0c1a tx timeout
[  264.571030] Bluetooth: hci4: command 0x0c1a tx timeout
[  264.571986] Bluetooth: hci3: command 0x0c1a tx timeout
[  264.572384] Bluetooth: hci2: command 0x0c1a tx timeout
[  264.573306] Bluetooth: hci1: command 0x0c1a tx timeout
18:03:12 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
pidfd_getfd(r1, r0, 0x0)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:12 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:12 executing program 3:
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', <r0=>0x0})
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r0}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r1)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r1)

18:03:12 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:12 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:12 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240), 0x2, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r3, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:03:12 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x0, &(0x7f0000000580)})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:12 executing program 2:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:12 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:12 executing program 2:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:12 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x0, &(0x7f0000000580)})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:12 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, 0x0, 0x20000000)

[  271.123074] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  271.124170] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  271.124979] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  271.126185] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  271.127291] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  271.128392] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  271.129660] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  271.130392] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  272.313553] Bluetooth: hci0: command 0x0c1a tx timeout
[  273.148687] Bluetooth: hci7: command 0x0c1a tx timeout
[  273.149759] Bluetooth: hci6: command 0x0c1a tx timeout
[  273.150745] Bluetooth: hci5: command 0x0c1a tx timeout
[  273.151710] Bluetooth: hci4: command 0x0c1a tx timeout
[  273.152673] Bluetooth: hci3: command 0x0c1a tx timeout
[  273.153467] Bluetooth: hci2: command 0x0c1a tx timeout
[  273.153606] Bluetooth: hci1: command 0x0c1a tx timeout
18:03:21 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x0, &(0x7f0000000580)})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:21 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
openat$cgroup(r1, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r2, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:03:21 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
pidfd_getfd(r1, r0, 0x0)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:21 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, 0x0, 0x20000000)

18:03:21 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:21 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:21 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:21 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:21 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x0, 0x1, 0x7, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:21 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, 0x0, 0x20000000)

18:03:21 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:21 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:21 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r1=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r1, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:21 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:21 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x0, 0x1, 0x7, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:22 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:22 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

[  280.379695] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  280.380820] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  280.381796] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  280.382858] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  280.383878] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  280.384937] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  280.386049] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  280.387150] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  281.593510] Bluetooth: hci0: command 0x0c1a tx timeout
[  282.426550] Bluetooth: hci7: command 0x0c1a tx timeout
[  282.427627] Bluetooth: hci6: command 0x0c1a tx timeout
[  282.428623] Bluetooth: hci5: command 0x0c1a tx timeout
[  282.429596] Bluetooth: hci4: command 0x0c1a tx timeout
[  282.430574] Bluetooth: hci3: command 0x0c1a tx timeout
[  282.431472] Bluetooth: hci2: command 0x0c1a tx timeout
[  282.431521] Bluetooth: hci1: command 0x0c1a tx timeout
18:03:30 executing program 7:
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r0, 0x3309)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:30 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x6)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r2, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:03:30 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x0, 0x1, 0x7, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:30 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:30 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:30 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, 0x0, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:30 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r1=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r1, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:30 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
pidfd_getfd(r1, r0, 0x0)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:30 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:30 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74, 0x0, 0x7, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:30 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:30 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000040}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:30 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r3, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:30 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r1=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r1, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000580)=""/198)
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:30 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74, 0x0, 0x7, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:30 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74, 0x0, 0x0, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

[  288.767455] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  288.768119] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  288.769342] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  288.770542] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  288.771137] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  288.772203] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  288.773204] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  288.774086] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  289.977514] Bluetooth: hci0: command 0x0c1a tx timeout
[  290.809536] Bluetooth: hci6: command 0x0c1a tx timeout
[  290.810596] Bluetooth: hci5: command 0x0c1a tx timeout
[  290.811706] Bluetooth: hci2: command 0x0c1a tx timeout
[  290.812822] Bluetooth: hci1: command 0x0c1a tx timeout
[  290.814609] Bluetooth: hci7: command 0x0c1a tx timeout
[  290.815724] Bluetooth: hci4: command 0x0c1a tx timeout
[  290.816821] Bluetooth: hci3: command 0x0c1a tx timeout
18:03:39 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:39 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
read$snapshot(0xffffffffffffffff, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:39 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:39 executing program 7:
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:39 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74, 0x0, 0x0, 0x5}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:39 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = openat$cgroup_ro(r0, &(0x7f0000000180)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r2, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r1)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:03:39 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:39 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

[  297.018711] Zero length message leads to an empty skb
18:03:39 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:39 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(&(0x7f0000000300), r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:39 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:39 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x24008040)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:39 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:39 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:39 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:39 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, r0)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

18:03:39 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r0)

[  297.845916] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  297.846678] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  297.847280] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  297.848392] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  297.849361] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  297.850397] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  297.851541] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  297.852171] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  299.066500] Bluetooth: hci0: command 0x0c1a tx timeout
[  299.898472] Bluetooth: hci7: command 0x0c1a tx timeout
[  299.898517] Bluetooth: hci6: command 0x0c1a tx timeout
[  299.899342] Bluetooth: hci5: command 0x0c1a tx timeout
[  299.900330] Bluetooth: hci4: command 0x0c1a tx timeout
[  299.900361] Bluetooth: hci3: command 0x0c1a tx timeout
[  299.900386] Bluetooth: hci2: command 0x0c1a tx timeout
[  299.900411] Bluetooth: hci1: command 0x0c1a tx timeout
18:03:48 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:48 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x0, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:48 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:48 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(0x0, r0)

18:03:48 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x40010, r0, 0x6)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r1, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:03:48 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
read$snapshot(0xffffffffffffffff, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:48 executing program 7:
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:48 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:48 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:48 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x0, 0x0, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:48 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(0x0, r0)

18:03:48 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:48 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000680)={0x0, 0x2, 0xffffffffffffffff, 0xfff0, 0x80000})

18:03:48 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x0, 0x0, 0x0, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:48 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:48 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x94, 0x0, 0x0, 0x0, 0x0, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}]}, 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:48 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(0x0, r0)

[  307.248765] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  307.251262] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  307.253883] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  307.255218] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  307.256875] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  307.258288] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  307.260172] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  307.261949] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  308.476664] Bluetooth: hci0: command 0x0c1a tx timeout
[  309.305544] Bluetooth: hci7: command 0x0c1a tx timeout
[  309.306581] Bluetooth: hci6: command 0x0c1a tx timeout
[  309.307572] Bluetooth: hci5: command 0x0c1a tx timeout
[  309.308542] Bluetooth: hci4: command 0x0c1a tx timeout
[  309.309499] Bluetooth: hci3: command 0x0c1a tx timeout
[  309.310497] Bluetooth: hci2: command 0x0c1a tx timeout
[  309.311482] Bluetooth: hci1: command 0x0c1a tx timeout
18:03:58 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
read$snapshot(0xffffffffffffffff, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:58 executing program 5:
perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000580)=[{0x3f74}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, 0x0)

18:03:58 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:58 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xb2f}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44000055}, 0x81)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r1, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:03:58 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x88, 0x0, 0x0, 0x0, 0x0, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}]}, 0x88}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:58 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r2=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r2, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r3 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r3, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000009c0))
r4 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r4})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:03:58 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), 0xffffffffffffffff)

18:03:58 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000800), r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:58 executing program 7:
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:58 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x7c, 0x0, 0x0, 0x0, 0x0, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:59 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), 0xffffffffffffffff)

18:03:59 executing program 5:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x0, 0x0, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:59 executing program 7:
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:03:59 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x50, 0x0, 0x0, 0x0, 0x0, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:03:59 executing program 4:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(0x0, r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:03:59 executing program 7:
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

[  317.595747] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  317.597112] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  317.599359] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  317.601158] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  317.603082] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  317.604345] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  317.606901] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  317.608166] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  318.778462] Bluetooth: hci0: command 0x0c1a tx timeout
[  319.609660] Bluetooth: hci7: command 0x0c1a tx timeout
[  319.611014] Bluetooth: hci6: command 0x0c1a tx timeout
[  319.612024] Bluetooth: hci5: command 0x0c1a tx timeout
[  319.613021] Bluetooth: hci4: command 0x0c1a tx timeout
[  319.614030] Bluetooth: hci3: command 0x0c1a tx timeout
[  319.615029] Bluetooth: hci2: command 0x0c1a tx timeout
[  319.616028] Bluetooth: hci1: command 0x0c1a tx timeout
18:04:08 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, 0x0, 0x4000801)

18:04:08 executing program 5:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x0, 0x0, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:04:08 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:04:08 executing program 3:
sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), 0xffffffffffffffff)

18:04:08 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:08 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
syz_open_dev$vcsn(&(0x7f0000000000), 0x3, 0x228040)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r0, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:04:08 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:08 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:08 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x14}, 0x14}}, 0x20000000)

18:04:08 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(0x0, r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:08 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, 0x0, 0x4000801)

18:04:08 executing program 5:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xa0, 0x0, 0x0, 0x0, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffe}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x131}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)

18:04:08 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:08 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x14}, 0x14}}, 0x0)

18:04:08 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, 0x0, 0x4000801)

18:04:08 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(0x0, r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:08 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

[  326.871479] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  326.873500] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  326.877932] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  326.879327] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  326.880616] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  326.881763] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  326.882871] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  326.883975] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  328.058460] Bluetooth: hci0: command 0x0c1a tx timeout
[  328.890474] Bluetooth: hci7: command 0x0c1a tx timeout
[  328.890553] Bluetooth: hci6: command 0x0c1a tx timeout
[  328.891367] Bluetooth: hci5: command 0x0c1a tx timeout
[  328.892452] Bluetooth: hci3: command 0x0c1a tx timeout
[  328.893226] Bluetooth: hci2: command 0x0c1a tx timeout
[  328.894195] Bluetooth: hci1: command 0x0c1a tx timeout
[  328.895986] Bluetooth: hci4: command 0x0c1a tx timeout
18:04:18 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x7)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r0, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:04:18 executing program 5:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)

18:04:18 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:18 executing program 2:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:18 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:18 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:18 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:18 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(0x0, r0)
sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r2, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:18 executing program 5:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)

18:04:18 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:18 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, 0x0, 0x4000080)

18:04:18 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, r0)

[  337.213000] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  337.214172] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  337.215962] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  337.217976] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  337.219104] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  337.220353] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  337.223076] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  337.226046] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  338.425598] Bluetooth: hci0: command 0x0c1a tx timeout
[  339.257544] Bluetooth: hci7: command 0x0c1a tx timeout
[  339.258649] Bluetooth: hci6: command 0x0c1a tx timeout
[  339.259653] Bluetooth: hci5: command 0x0c1a tx timeout
[  339.260635] Bluetooth: hci4: command 0x0c1a tx timeout
[  339.261613] Bluetooth: hci3: command 0x0c1a tx timeout
[  339.262467] Bluetooth: hci2: command 0x0c1a tx timeout
[  339.262588] Bluetooth: hci1: command 0x0c1a tx timeout
18:04:27 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:27 executing program 2:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:27 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:27 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', <r3=>0x0})
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
r4 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r4, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:27 executing program 5:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)

18:04:27 executing program 6:
ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x72f)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r0, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:04:27 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, r0)

18:04:27 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, 0x0, 0x4000080)

18:04:27 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, 0x0, 0x4000080)

18:04:27 executing program 5:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)

18:04:27 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:27 executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, r0)

18:04:27 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:27 executing program 5:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)

18:04:27 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:27 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:27 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

[  346.244927] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  346.245768] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  346.246319] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  346.246949] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  346.247772] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  346.248369] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  346.249201] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  346.250014] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  347.450504] Bluetooth: hci0: command 0x0c1a tx timeout
[  348.282492] Bluetooth: hci7: command 0x0c1a tx timeout
[  348.283502] Bluetooth: hci6: command 0x0c1a tx timeout
[  348.284501] Bluetooth: hci5: command 0x0c1a tx timeout
[  348.284652] Bluetooth: hci4: command 0x0c1a tx timeout
[  348.285505] Bluetooth: hci3: command 0x0c1a tx timeout
[  348.285537] Bluetooth: hci2: command 0x0c1a tx timeout
[  348.285560] Bluetooth: hci1: command 0x0c1a tx timeout
18:04:37 executing program 5:
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)

18:04:37 executing program 2:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:37 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:04:37 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:37 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'})
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r2 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r2, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:37 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(r0, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:04:37 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:37 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:37 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:04:37 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:37 executing program 5:
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$SOCK_DESTROY(0xffffffffffffffff, 0x0, 0x0)

18:04:37 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={&(0x7f00000007c0), 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:37 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:04:37 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:37 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:37 executing program 2:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)

18:04:37 executing program 5:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:37 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={&(0x7f00000007c0), 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

[  355.865343] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  355.866284] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  355.868402] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  355.869195] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  355.870132] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  355.871980] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  355.872804] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  355.875055] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  357.050463] Bluetooth: hci0: command 0x0c1a tx timeout
[  357.881545] Bluetooth: hci6: command 0x0c1a tx timeout
[  357.882296] Bluetooth: hci5: command 0x0c1a tx timeout
[  357.882489] Bluetooth: hci4: command 0x0c1a tx timeout
[  357.882795] Bluetooth: hci3: command 0x0c1a tx timeout
[  357.883790] Bluetooth: hci2: command 0x0c1a tx timeout
[  357.884156] Bluetooth: hci1: command 0x0c1a tx timeout
[  357.885092] Bluetooth: hci7: command 0x0c1a tx timeout
18:04:46 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={&(0x7f00000007c0), 0xc, &(0x7f00000008c0)={&(0x7f0000000840)={0x64, r1, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7ff}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xa3ac}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:46 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'})
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r2 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r2, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:46 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f00000005c0)={0x0}}, 0x4000801)

18:04:46 executing program 6:
socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(0xffffffffffffffff, &(0x7f0000000340)=""/185, 0xb9, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:04:46 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r1=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r1, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:46 executing program 2:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))

18:04:46 executing program 5:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:46 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:04:46 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f00000005c0)={0x0}}, 0x0)

18:04:46 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:46 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

[  364.220812] 
[  364.221009] =====================================
[  364.221400] WARNING: bad unlock balance detected!
[  364.221786] 6.19.0-rc5-next-20260116 #1 Not tainted
[  364.222177] -------------------------------------
[  364.222551] syz-executor.4/5874 is trying to release lock (rcu_read_lock) at:
[  364.223113] [<ffffffff81c1dee5>] __wait_on_freeing_inode+0x105/0x350
[  364.223643] but there are no more locks to release!
[  364.224031] 
[  364.224031] other info that might help us debug this:
[  364.224543] 4 locks held by syz-executor.4/5874:
[  364.224914]  #0: ffff88800f7043f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400
[  364.226616]  #1: ffff88801bbcc698 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400
[  364.228906]  #2: ffff88800f710950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0
[  364.231262]  #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890
[  364.233382] 
[  364.233382] stack backtrace:
[  364.234330] CPU: 1 UID: 0 PID: 5874 Comm: syz-executor.4 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) 
[  364.234345] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  364.234352] Call Trace:
[  364.234357]  <TASK>
[  364.234361]  dump_stack_lvl+0xca/0x120
[  364.234391]  ? __wait_on_freeing_inode+0x105/0x350
[  364.234405]  print_unlock_imbalance_bug+0x118/0x130
[  364.234420]  ? __wait_on_freeing_inode+0x105/0x350
[  364.234434]  lock_release+0x1ee/0x270
[  364.234449]  __wait_on_freeing_inode+0x10a/0x350
[  364.234463]  ? __pfx___wait_on_freeing_inode+0x10/0x10
[  364.234478]  ? __pfx_var_wake_function+0x10/0x10
[  364.234495]  ? lock_is_held_type+0x9e/0x120
[  364.234507]  insert_inode_locked+0x25f/0x890
[  364.234524]  __ext4_new_inode+0x223d/0x4cd0
[  364.234541]  ? __pfx___ext4_new_inode+0x10/0x10
[  364.234555]  ? __pfx___dquot_initialize+0x10/0x10
[  364.234572]  ? __pfx_avc_has_perm+0x10/0x10
[  364.234588]  ext4_symlink+0x623/0xb40
[  364.234606]  ? __pfx_ext4_symlink+0x10/0x10
[  364.234622]  ? security_inode_permission+0x72/0xe0
[  364.234634]  vfs_symlink+0x44b/0x840
[  364.234650]  filename_symlinkat+0x158/0x440
[  364.234664]  ? __pfx_filename_symlinkat+0x10/0x10
[  364.234677]  ? strncpy_from_user+0x21b/0x2f0
[  364.234694]  __x64_sys_symlink+0x82/0x110
[  364.234707]  do_syscall_64+0xbf/0x420
[  364.234719]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  364.234732] RIP: 0033:0x7f834b096427
[  364.234741] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  364.234752] RSP: 002b:00007ffdb1b58f48 EFLAGS: 00000206 ORIG_RAX: 0000000000000058
[  364.234762] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f834b096427
[  364.234770] RDX: 00007ffdb1b59023 RSI: 00007f834b0f102f RDI: 00007ffdb1b59010
[  364.234777] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffdb1b58de0
[  364.234784] R10: 00007ffdb1b58c97 R11: 0000000000000206 R12: 0000000000000001
[  364.234791] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffdb1b59010
[  364.234801]  </TASK>
[  364.250032] ------------[ cut here ]------------
[  364.271795] WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#1: syz-executor.4/5874
[  364.298016] Modules linked in:
[  364.298313] CPU: 1 UID: 0 PID: 5874 Comm: syz-executor.4 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) 
[  364.320630] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  364.321281] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0
[  364.344898] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9
[  364.376616] RSP: 0018:ffff88804683f9a0 EFLAGS: 00010286
[  364.377047] RAX: 00000000ffffffff RBX: ffff88801defb700 RCX: ffffffff815660f7
[  364.406328] RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff88801defbafc
[  364.436793] RBP: ffff88801defb700 R08: 0000000000000000 R09: fffffbfff0ba7040
[  364.437355] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88801defb700
[  364.467580] R13: 0000000000000001 R14: ffffffff85c0f180 R15: ffff88801b9c1628
[  364.468145] FS:  00005555745c3400(0000) GS:ffff8880e5442000(0000) knlGS:0000000000000000
[  364.497559] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  364.498029] CR2: 00007f3afee9e894 CR3: 000000000e031000 CR4: 0000000000350ef0
[  364.528563] Call Trace:
[  364.528810]  <TASK>
[  364.546529]  __wait_on_freeing_inode+0x10f/0x350
[  364.547192]  ? __pfx___wait_on_freeing_inode+0x10/0x10
[  364.648922]  ? __pfx_var_wake_function+0x10/0x10
[  364.719353]  ? lock_is_held_type+0x9e/0x120
[  364.722743]  insert_inode_locked+0x25f/0x890
[  364.724329]  __ext4_new_inode+0x223d/0x4cd0
[  364.726796]  ? __pfx___ext4_new_inode+0x10/0x10
[  364.728006]  ? __pfx___dquot_initialize+0x10/0x10
[  364.728800]  ? __pfx_avc_has_perm+0x10/0x10
[  364.730653]  ext4_symlink+0x623/0xb40
[  364.732870]  ? __pfx_ext4_symlink+0x10/0x10
[  364.733868]  ? security_inode_permission+0x72/0xe0
[  364.735499]  vfs_symlink+0x44b/0x840
[  364.736755]  filename_symlinkat+0x158/0x440
[  364.737873]  ? __pfx_filename_symlinkat+0x10/0x10
[  364.738674]  ? strncpy_from_user+0x21b/0x2f0
[  364.740554]  __x64_sys_symlink+0x82/0x110
[  364.741253]  do_syscall_64+0xbf/0x420
[  364.742062]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  364.742606] RIP: 0033:0x7f834b096427
[  364.742966] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  364.744480] RSP: 002b:00007ffdb1b58f48 EFLAGS: 00000206 ORIG_RAX: 0000000000000058
[  364.745079] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f834b096427
[  364.745683] RDX: 00007ffdb1b59023 RSI: 00007f834b0f102f RDI: 00007ffdb1b59010
[  364.746245] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffdb1b58de0
[  364.746846] R10: 00007ffdb1b58c97 R11: 0000000000000206 R12: 0000000000000001
[  364.747462] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffdb1b59010
[  364.750025]  </TASK>
[  364.750221] irq event stamp: 427
[  364.750536] hardirqs last  enabled at (427): [<ffffffff84ced36b>] irqentry_exit+0x17b/0x650
[  364.751259] hardirqs last disabled at (426): [<ffffffff84cec06f>] sysvec_apic_timer_interrupt+0xf/0x80
[  364.752113] softirqs last  enabled at (420): [<ffffffff812cda79>] kernel_fpu_end+0x59/0x70
[  364.752876] softirqs last disabled at (418): [<ffffffff812ce94b>] kernel_fpu_begin_mask+0x1bb/0x300
[  364.753697] ---[ end trace 0000000000000000 ]---
18:04:46 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r1=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r1, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:46 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:04:46 executing program 5:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:47 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

[  364.839731] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  364.841305] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  364.845019] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  364.845932] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  364.853610] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  364.860579] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  364.861570] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  364.868740] Bluetooth: hci7: Opcode 0x0c1a failed: -4
18:04:47 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:04:47 executing program 6:
socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:04:47 executing program 5:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)

18:04:47 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00'})
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r2 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r2, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:47 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:47 executing program 2:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))

18:04:47 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

[  365.804486] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  365.805337] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  365.807020] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  365.808367] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  365.809706] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  365.811068] Bluetooth: hci5: Opcode 0x0c1a failed: -4
[  365.811978] Bluetooth: hci6: Opcode 0x0c1a failed: -4
[  365.813512] Bluetooth: hci7: Opcode 0x0c1a failed: -4
[  367.034503] Bluetooth: hci0: command 0x0c1a tx timeout
[  367.865912] Bluetooth: hci7: command 0x0c1a tx timeout
[  367.866498] Bluetooth: hci6: command 0x0c1a tx timeout
[  367.866603] Bluetooth: hci5: command 0x0c1a tx timeout
[  367.866975] Bluetooth: hci4: command 0x0c1a tx timeout
[  367.868000] Bluetooth: hci3: command 0x0c1a tx timeout
[  367.868319] Bluetooth: hci2: command 0x0c1a tx timeout
[  367.869130] Bluetooth: hci1: command 0x0c1a tx timeout
18:04:55 executing program 4:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000900)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4000080)

18:04:55 executing program 1:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', <r1=>0x0})
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, r1, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))
ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000c00)=""/12)
ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000c40)=""/90)

18:04:55 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f00000005c0)={0x0}}, 0x0)

18:04:55 executing program 2:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))

18:04:55 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)

18:04:55 executing program 5:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x802, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x88)
r0 = socket$inet(0x2, 0x6, 0x3)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f0000000180)={0x11, 0x64, &(0x7f0000000100)="5853d4977c534eadc47787881ca4433ed5525ccfd9f02783abf696abf54e982c10595a5a71103dad3280d36bc1ef8d6194c6b55aabe6f39d9281d1c6b91aa93175647565327c875b1d7e3d388961db3ebf44f6a0f64b261b5ffc1c40bbe53364a025c197"})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e21, 0x7c03, 0x4e24, 0x7f, 0x2, 0xd0, 0x20, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x1ff, 0x8000, 0xdb, 0x1, 0x81, 0x62, 0x10000}, {0x9, 0x1, 0xfffffffffffffff9, 0x7fffffff}, 0x60, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d4, 0x32}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3503, 0x0, 0x3, 0x1f, 0x9, 0xfffeffff, 0x4}}, 0xe8)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000500)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x20000440, 0x20000470, 0x200004a0], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108)
mount$9p_fd(0x0, &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0), 0x4, &(0x7f0000000700)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@access_any}, {@msize={'msize', 0x3d, 0x6}}, {@access_uid}], [{@obj_user={'obj_user', 0x3d, './binderfs/custom1\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@hash}]}})
ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0))
r2 = socket$inet(0x2, 0x4, 0x1)
recvfrom(r2, &(0x7f0000000840)=""/202, 0xca, 0x1, &(0x7f0000000940)=@xdp={0x2c, 0x1, 0x0, 0x8}, 0x80)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000009c0))
r3 = io_uring_setup(0x688, &(0x7f0000000a00)={0x0, 0x702c, 0x28, 0x2, 0x153})
io_uring_setup(0x407, &(0x7f0000000a80)={0x0, 0x9045, 0x2, 0x3, 0x355, 0x0, r3})
socket$inet6_udp(0xa, 0x2, 0x0)
syz_io_uring_setup(0x3b68, &(0x7f0000000b00)={0x0, 0x4c42, 0x8, 0x1, 0x127}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000b80), &(0x7f0000000bc0))

18:04:55 executing program 6:
socket$inet_tcp(0x2, 0x1, 0x0)
recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(&(0x7f0000000440), 0xffffffffffffffff)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000005c0), 0x920, 0x0)

18:04:55 executing program 0:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r1, 0x3309)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, &(0x7f0000000080)={0x4, 0x9})
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x1)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, &(0x7f00000000c0))
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1)
sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xb2}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x60}, 0x1, 0x0, 0x0, 0x8084}, 0x9010)
setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x6, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'sh\x00', 0x20, 0x28b75a28, 0x57}, {@local, 0x4e21, 0x10000, 0x3, 0x9f49, 0x8}}, 0x44)
r3 = pidfd_getfd(r1, r0, 0x0)
read$snapshot(r3, &(0x7f0000000340)=""/155, 0x9b)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000801)

18:04:56 executing program 7:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f00000005c0)={0x0}}, 0x0)

18:04:56 executing program 3:
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, 0x0, 0x0)
syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)


VM DIAGNOSIS:
18:04:46  Registers:
info registers vcpu 0
RAX=ffffffff81baf320 RBX=0000000000000005 RCX=0000000000000000 RDX=0000000000000000
RSI=0000000000000008 RDI=ffff88804248fae0 RBP=dffffc0000000000 RSP=ffff88804248fa28
R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000003
R12=0000000000000008 R13=0000000000000000 R14=ffff88804248fab8 R15=ffff888009828140
RIP=ffffffff8161daf9 RFL=00000283 [--S---C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007ff8cca23540 00000000 00000000
GS =0000 ffff8880e5342000 00000000 00000000
LDT=0000 fffffe2300000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000555904dc24c8 CR3=000000001e9de000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00642e65626f7270646f6d2f6374652f XMM01=00642e65626f7270646f6d2f6374652f
XMM02=00000000000000000000ffffffffffff XMM03=00000000000000000000ff00000000ff
XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=676f6c206d6f74737563000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000033 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff82975135 RDI=ffffffff889c19e0 RBP=ffffffff889c19a0 RSP=ffff88804683f4a8
R8 =0000000000000000 R9 =ffffed1001624046 R10=0000000000000033 R11=6162206b63617473
R12=0000000000000033 R13=0000000000000010 R14=ffffffff889c19a0 R15=ffffffff82975120
RIP=ffffffff8297518d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00005555745c3400 00000000 00000000
GS =0000 ffff8880e5442000 00000000 00000000
LDT=0000 fffffe1900000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f3afee9e894 CR3=000000000e031000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11
XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000
XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000