Warning: Permanently added '[localhost]:21928' (ECDSA) to the list of known hosts.
2026/01/19 01:51:02 fuzzer started
2026/01/19 01:51:02 dialing manager at localhost:42157
syzkaller login: [   45.430699] cgroup: Unknown subsys name 'net'
[   45.479531] cgroup: Unknown subsys name 'cpuset'
[   45.492990] cgroup: Unknown subsys name 'rlimit'
2026/01/19 01:51:14 syscalls: 202
2026/01/19 01:51:14 code coverage: enabled
2026/01/19 01:51:14 comparison tracing: enabled
2026/01/19 01:51:14 extra coverage: enabled
2026/01/19 01:51:14 setuid sandbox: enabled
2026/01/19 01:51:14 namespace sandbox: enabled
2026/01/19 01:51:14 Android sandbox: enabled
2026/01/19 01:51:14 fault injection: enabled
2026/01/19 01:51:14 leak checking: enabled
2026/01/19 01:51:14 net packet injection: enabled
2026/01/19 01:51:14 net device setup: enabled
2026/01/19 01:51:14 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2026/01/19 01:51:14 devlink PCI setup: PCI device 0000:00:10.0 is not available
2026/01/19 01:51:14 USB emulation: enabled
2026/01/19 01:51:14 hci packet injection: enabled
2026/01/19 01:51:14 wifi device emulation: enabled
2026/01/19 01:51:14 802.15.4 emulation: enabled
2026/01/19 01:51:14 fetching corpus: 0, signal 0/0 (executing program)
2026/01/19 01:51:14 starting 8 fuzzer processes
01:51:14 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
r4 = openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r4)
pipe2$9p(&(0x7f00000005c0), 0x80000)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000600)=0x40, 0x4)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:51:14 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r5 = fork()
sched_setaffinity(r5, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f00000003c0))
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x2, 0x4)
r6 = getpid()
sched_setscheduler(r6, 0x1, &(0x7f0000000440)=0x200)

01:51:14 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
write$tcp_mem(r5, &(0x7f0000000480)={0x7fffffff, 0x20, 0x0, 0x20, 0x9}, 0x48)
r6 = socket(0x1e, 0x80000, 0xa7)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000500)=0x8, 0x4)
r7 = syz_open_dev$vcsn(&(0x7f0000000540), 0x660, 0x4000)
bind$bt_l2cap(r7, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2)

01:51:14 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
getresgid(&(0x7f0000002640)=<r11=>0x0, &(0x7f0000002680), &(0x7f00000026c0))
getgroups(0x3, &(0x7f0000002700)=[r2, r2, r11])
pipe2$9p(&(0x7f00000027c0)={<r12=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

[   55.908645] audit: type=1400 audit(1768787474.816:7): avc:  denied  { execmem } for  pid=273 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
01:51:14 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
r3 = semget$private(0x0, 0x1, 0x0)
semctl$GETALL(r3, 0x0, 0xd, &(0x7f00000033c0)=""/246)
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000034c0))
semop(0xffffffffffffffff, &(0x7f0000003500)=[{0x0, 0x0, 0x1000}, {0xe, 0x1c0, 0x800}, {0x1, 0xfeff, 0x1000}, {0x1, 0x4, 0x800}, {0x2, 0x40}, {0x4, 0x0, 0x1000}, {0x1}], 0x7)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))
ioctl$SCSI_IOCTL_PROBE_HOST(0xffffffffffffffff, 0x5385, &(0x7f0000003580)={0xe8, ""/232})

01:51:14 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
r6 = geteuid()
getresgid(&(0x7f00000003c0), &(0x7f0000000400)=<r7=>0x0, &(0x7f0000000440))
r8 = getpid()
r9 = getpid()
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, r5, 0xffffffffffffffff, r6, r7, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, r8, r9, 0x7})

01:51:14 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
r5 = memfd_secret(0x80000)
write$cgroup_int(r5, &(0x7f0000000880)=0x3, 0x12)
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000008c0))
ioctl$BTRFS_IOC_LOGICAL_INO_V2(0xffffffffffffffff, 0xc038943b, &(0x7f00000009c0)={0x4, 0x40, '\x00', 0x1, &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})

01:51:14 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
clock_gettime(0x4, &(0x7f0000000540))
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

[   56.984217] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   56.989181] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   56.993338] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   56.998384] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   57.001193] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   57.056513] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   57.063038] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   57.064754] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   57.066353] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   57.068323] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   57.069716] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   57.076097] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   57.077697] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   57.080325] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   57.082160] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   57.185869] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   57.196103] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   57.199300] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   57.200905] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   57.206364] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   57.207901] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   57.211643] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   57.211724] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   57.217263] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   57.217716] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   57.275594] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   57.317581] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[   57.319576] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   57.321286] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   57.331067] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[   57.333282] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[   57.344849] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[   57.346876] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[   57.353083] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[   57.359850] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   57.362753] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[   57.366150] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   57.388554] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[   57.399382] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[   57.407077] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[   59.018075] Bluetooth: hci0: command tx timeout
[   59.145429] Bluetooth: hci2: command tx timeout
[   59.146317] Bluetooth: hci1: command tx timeout
[   59.273208] Bluetooth: hci4: command tx timeout
[   59.274285] Bluetooth: hci3: command tx timeout
[   59.467188] Bluetooth: hci6: command tx timeout
[   59.529989] Bluetooth: hci7: command tx timeout
[   59.531061] Bluetooth: hci5: command tx timeout
[   61.065636] Bluetooth: hci0: command tx timeout
[   61.194085] Bluetooth: hci2: command tx timeout
[   61.194591] Bluetooth: hci1: command tx timeout
[   61.321948] Bluetooth: hci4: command tx timeout
[   61.322396] Bluetooth: hci3: command tx timeout
[   61.513052] Bluetooth: hci6: command tx timeout
[   61.576961] Bluetooth: hci7: command tx timeout
[   61.577391] Bluetooth: hci5: command tx timeout
[   63.112991] Bluetooth: hci0: command tx timeout
[   63.240994] Bluetooth: hci1: command tx timeout
[   63.241402] Bluetooth: hci2: command tx timeout
[   63.369909] Bluetooth: hci3: command tx timeout
[   63.369987] Bluetooth: hci4: command tx timeout
[   63.561973] Bluetooth: hci6: command tx timeout
[   63.625952] Bluetooth: hci5: command tx timeout
[   63.626354] Bluetooth: hci7: command tx timeout
[   65.161944] Bluetooth: hci0: command tx timeout
[   65.289003] Bluetooth: hci2: command tx timeout
[   65.289470] Bluetooth: hci1: command tx timeout
[   65.417097] Bluetooth: hci3: command tx timeout
[   65.417558] Bluetooth: hci4: command tx timeout
[   65.609088] Bluetooth: hci6: command tx timeout
[   65.673149] Bluetooth: hci7: command tx timeout
[   65.673900] Bluetooth: hci5: command tx timeout
[   96.167349] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.168029] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.378278] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.378852] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.674737] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.675408] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.860522] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.861958] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
01:51:56 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
clock_gettime(0x4, &(0x7f0000000540))
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:51:56 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
r3 = semget$private(0x0, 0x1, 0x0)
semctl$GETALL(r3, 0x0, 0xd, &(0x7f00000033c0)=""/246)
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000034c0))
semop(0xffffffffffffffff, &(0x7f0000003500)=[{0x0, 0x0, 0x1000}, {0xe, 0x1c0, 0x800}, {0x1, 0xfeff, 0x1000}, {0x1, 0x4, 0x800}, {0x2, 0x40}, {0x4, 0x0, 0x1000}, {0x1}], 0x7)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))
ioctl$SCSI_IOCTL_PROBE_HOST(0xffffffffffffffff, 0x5385, &(0x7f0000003580)={0xe8, ""/232})

01:51:56 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
r3 = semget$private(0x0, 0x1, 0x0)
semctl$GETALL(r3, 0x0, 0xd, &(0x7f00000033c0)=""/246)
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000034c0))
semop(0xffffffffffffffff, &(0x7f0000003500)=[{0x0, 0x0, 0x1000}, {0xe, 0x1c0, 0x800}, {0x1, 0xfeff, 0x1000}, {0x1, 0x4, 0x800}, {0x2, 0x40}, {0x4, 0x0, 0x1000}, {0x1}], 0x7)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))
ioctl$SCSI_IOCTL_PROBE_HOST(0xffffffffffffffff, 0x5385, &(0x7f0000003580)={0xe8, ""/232})

[   97.487538] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   97.489265] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
01:51:56 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
r3 = semget$private(0x0, 0x1, 0x0)
semctl$GETALL(r3, 0x0, 0xd, &(0x7f00000033c0)=""/246)
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000034c0))
semop(0xffffffffffffffff, &(0x7f0000003500)=[{0x0, 0x0, 0x1000}, {0xe, 0x1c0, 0x800}, {0x1, 0xfeff, 0x1000}, {0x1, 0x4, 0x800}, {0x2, 0x40}, {0x4, 0x0, 0x1000}, {0x1}], 0x7)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))
ioctl$SCSI_IOCTL_PROBE_HOST(0xffffffffffffffff, 0x5385, &(0x7f0000003580)={0xe8, ""/232})

01:51:56 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
clock_gettime(0x4, &(0x7f0000000540))
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:51:56 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
r3 = semget$private(0x0, 0x1, 0x0)
semctl$GETALL(r3, 0x0, 0xd, &(0x7f00000033c0)=""/246)
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000034c0))
semop(0xffffffffffffffff, &(0x7f0000003500)=[{0x0, 0x0, 0x1000}, {0xe, 0x1c0, 0x800}, {0x1, 0xfeff, 0x1000}, {0x1, 0x4, 0x800}, {0x2, 0x40}, {0x4, 0x0, 0x1000}, {0x1}], 0x7)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

[   97.645271] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   97.645876] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
01:51:56 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
r3 = semget$private(0x0, 0x1, 0x0)
semctl$GETALL(r3, 0x0, 0xd, &(0x7f00000033c0)=""/246)
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f00000034c0))
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

[   97.718978] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   97.719588] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
01:51:56 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
r3 = semget$private(0x0, 0x1, 0x0)
semctl$GETALL(r3, 0x0, 0xd, &(0x7f00000033c0)=""/246)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

[   97.861238] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   97.861835] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.068456] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.069140] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.233047] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.233635] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.289749] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.290366] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.362233] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.362854] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.894742] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.895729] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   98.962419] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   98.963042] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.387208] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.388942] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.458370] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   99.459463] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
01:52:10 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
write$tcp_mem(r5, &(0x7f0000000480)={0x7fffffff, 0x20, 0x0, 0x20, 0x9}, 0x48)
r6 = socket(0x1e, 0x80000, 0xa7)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000500)=0x8, 0x4)
r7 = syz_open_dev$vcsn(&(0x7f0000000540), 0x660, 0x4000)
bind$bt_l2cap(r7, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2)

01:52:10 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
r4 = openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r4)
pipe2$9p(&(0x7f00000005c0), 0x80000)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000600)=0x40, 0x4)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:10 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
semget$private(0x0, 0x1, 0x0)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:10 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
clock_gettime(0x4, &(0x7f0000000540))
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:52:10 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r5 = fork()
sched_setaffinity(r5, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f00000003c0))
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x2, 0x4)
r6 = getpid()
sched_setscheduler(r6, 0x1, &(0x7f0000000440)=0x200)

01:52:10 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
r6 = geteuid()
getresgid(&(0x7f00000003c0), &(0x7f0000000400)=<r7=>0x0, &(0x7f0000000440))
r8 = getpid()
r9 = getpid()
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, r5, 0xffffffffffffffff, r6, r7, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, r8, r9, 0x7})

01:52:10 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
r5 = memfd_secret(0x80000)
write$cgroup_int(r5, &(0x7f0000000880)=0x3, 0x12)
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000008c0))
ioctl$BTRFS_IOC_LOGICAL_INO_V2(0xffffffffffffffff, 0xc038943b, &(0x7f00000009c0)={0x4, 0x40, '\x00', 0x1, &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})

01:52:10 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
getresgid(&(0x7f0000002640)=<r11=>0x0, &(0x7f0000002680), &(0x7f00000026c0))
getgroups(0x3, &(0x7f0000002700)=[r2, r2, r11])
pipe2$9p(&(0x7f00000027c0)={<r12=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:10 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
r2 = semget$private(0x0, 0x0, 0x0)
semctl$GETVAL(r2, 0x1, 0xc, &(0x7f00000023c0)=""/4096)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:10 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
r5 = memfd_secret(0x80000)
write$cgroup_int(r5, &(0x7f0000000880)=0x3, 0x12)
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000008c0))
ioctl$BTRFS_IOC_LOGICAL_INO_V2(0xffffffffffffffff, 0xc038943b, &(0x7f00000009c0)={0x4, 0x40, '\x00', 0x1, &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})

01:52:10 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
getresgid(&(0x7f0000002640)=<r11=>0x0, &(0x7f0000002680), &(0x7f00000026c0))
getgroups(0x3, &(0x7f0000002700)=[r2, r2, r11])
pipe2$9p(&(0x7f00000027c0)={<r12=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:10 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r5 = fork()
sched_setaffinity(r5, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f00000003c0))
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x2, 0x4)
r6 = getpid()
sched_setscheduler(r6, 0x1, &(0x7f0000000440)=0x200)

01:52:18 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
getresgid(&(0x7f0000002640)=<r11=>0x0, &(0x7f0000002680), &(0x7f00000026c0))
getgroups(0x3, &(0x7f0000002700)=[r2, r2, r11])
pipe2$9p(&(0x7f00000027c0)={<r12=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r12}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:18 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r5 = fork()
sched_setaffinity(r5, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f00000003c0))
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x2, 0x4)
r6 = getpid()
sched_setscheduler(r6, 0x1, &(0x7f0000000440)=0x200)

01:52:18 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
r5 = memfd_secret(0x80000)
write$cgroup_int(r5, &(0x7f0000000880)=0x3, 0x12)
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000008c0))
ioctl$BTRFS_IOC_LOGICAL_INO_V2(0xffffffffffffffff, 0xc038943b, &(0x7f00000009c0)={0x4, 0x40, '\x00', 0x1, &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})

01:52:18 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
r6 = geteuid()
getresgid(&(0x7f00000003c0), &(0x7f0000000400)=<r7=>0x0, &(0x7f0000000440))
r8 = getpid()
r9 = getpid()
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, r5, 0xffffffffffffffff, r6, r7, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, r8, r9, 0x7})

01:52:18 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
r4 = openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r4)
pipe2$9p(&(0x7f00000005c0), 0x80000)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000600)=0x40, 0x4)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:18 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
semget$private(0x0, 0x0, 0x0)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:18 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
clock_gettime(0x4, &(0x7f0000000540))
kcmp$KCMP_EPOLL_TFD(r5, 0x0, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:52:18 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
write$tcp_mem(r5, &(0x7f0000000480)={0x7fffffff, 0x20, 0x0, 0x20, 0x9}, 0x48)
r6 = socket(0x1e, 0x80000, 0xa7)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000500)=0x8, 0x4)
r7 = syz_open_dev$vcsn(&(0x7f0000000540), 0x660, 0x4000)
bind$bt_l2cap(r7, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2)

01:52:18 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
r5 = memfd_secret(0x80000)
write$cgroup_int(r5, &(0x7f0000000880)=0x3, 0x12)
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000008c0))

01:52:19 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
semctl$GETNCNT(r1, 0x0, 0xe, &(0x7f0000002340)=""/69)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:19 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
r6 = geteuid()
getresgid(&(0x7f00000003c0), &(0x7f0000000400)=<r7=>0x0, &(0x7f0000000440))
r8 = getpid()
r9 = getpid()
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, r5, 0xffffffffffffffff, r6, r7, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, r8, r9, 0x7})

01:52:19 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
clock_gettime(0x4, &(0x7f0000000540))
kcmp$KCMP_EPOLL_TFD(r5, 0x0, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:52:19 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
r5 = memfd_secret(0x80000)
write$cgroup_int(r5, &(0x7f0000000880)=0x3, 0x12)

01:52:19 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r5 = fork()
sched_setaffinity(r5, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f00000003c0))
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x2, 0x4)
sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x200)

01:52:19 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
write$tcp_mem(r5, &(0x7f0000000480)={0x7fffffff, 0x20, 0x0, 0x20, 0x9}, 0x48)
r6 = socket(0x1e, 0x80000, 0xa7)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000500)=0x8, 0x4)
r7 = syz_open_dev$vcsn(&(0x7f0000000540), 0x660, 0x4000)
bind$bt_l2cap(r7, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2)

01:52:27 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
r4 = openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r4)
pipe2$9p(&(0x7f00000005c0), 0x80000)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000600)=0x40, 0x4)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:27 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
write$tcp_mem(r5, &(0x7f0000000480)={0x7fffffff, 0x20, 0x0, 0x20, 0x9}, 0x48)
r6 = socket(0x1e, 0x80000, 0xa7)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000500)=0x8, 0x4)
r7 = syz_open_dev$vcsn(&(0x7f0000000540), 0x660, 0x4000)
bind$bt_l2cap(r7, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:52:27 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
r6 = geteuid()
getresgid(&(0x7f00000003c0), &(0x7f0000000400)=<r7=>0x0, &(0x7f0000000440))
r8 = getpid()
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, r5, 0xffffffffffffffff, r6, r7, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, r8, 0x0, 0x7})

01:52:27 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
clock_gettime(0x4, &(0x7f0000000540))
kcmp$KCMP_EPOLL_TFD(r5, 0x0, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:52:27 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r5 = fork()
sched_setaffinity(r5, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f00000003c0))
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x2, 0x4)
sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x200)

01:52:27 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f00000022c0)=""/125)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:27 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000880)=0x3, 0x12)

01:52:27 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
getresgid(&(0x7f0000002640)=<r11=>0x0, &(0x7f0000002680), &(0x7f00000026c0))
getgroups(0x3, &(0x7f0000002700)=[r2, r2, r11])
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:27 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000880)=0x3, 0x12)

01:52:27 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
waitid$P_PIDFD(0x3, r4, &(0x7f0000000740), 0x1000000, &(0x7f00000007c0))
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000880)=0x3, 0x12)

01:52:27 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
semctl$SEM_STAT(r0, 0x0, 0x12, &(0x7f00000012c0)=""/4096)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:27 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
r4 = openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r4)
pipe2$9p(&(0x7f00000005c0), 0x80000)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:27 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
getresgid(&(0x7f0000002640)=<r11=>0x0, &(0x7f0000002680), &(0x7f00000026c0))
getgroups(0x3, &(0x7f0000002700)=[r2, r2, r11])
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:35 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
getresgid(&(0x7f0000002640)=<r11=>0x0, &(0x7f0000002680), &(0x7f00000026c0))
getgroups(0x3, &(0x7f0000002700)=[r2, r2, r11])
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:35 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r5 = fork()
sched_setaffinity(r5, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f00000003c0))
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x2, 0x4)
sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x200)

01:52:35 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
semctl$SETVAL(r0, 0x1, 0x10, &(0x7f0000001280)=0x10000)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:35 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
r6 = geteuid()
getresgid(&(0x7f00000003c0), &(0x7f0000000400)=<r7=>0x0, &(0x7f0000000440))
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, r5, 0xffffffffffffffff, r6, r7, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:52:35 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:52:35 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
write$tcp_mem(r5, &(0x7f0000000480)={0x7fffffff, 0x20, 0x0, 0x20, 0x9}, 0x48)
r6 = socket(0x1e, 0x80000, 0xa7)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000500)=0x8, 0x4)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:52:35 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
r4 = openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r4)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:35 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/module/libata', 0xbc4e604e9330d1f1, 0x40)
r4 = memfd_secret(0x80000)
write$cgroup_int(r4, &(0x7f0000000880)=0x3, 0x12)

01:52:35 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000001240)=""/50)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:35 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, <r3=>r1}, './file0\x00'})
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0x9c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfff}, @NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_SOCKETS={0x44, 0x7, 0x0, 0x1, [{0x8, 0x1, r1}, {0x8, 0x1, r3}, {0x8, 0x1, r2}, {0x8, 0x1, r0}, {0x8, 0x1, r0}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x9c}}, 0x800)
r4 = memfd_secret(0x80000)
write$cgroup_int(r4, &(0x7f0000000880)=0x3, 0x12)

01:52:35 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r11=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r11}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:45 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
r1 = semget(0x1, 0x4, 0x5a0)
semctl$IPC_INFO(r1, 0x0, 0x3, &(0x7f0000000240)=""/4096)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:45 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
pipe2$9p(&(0x7f00000027c0)={<r11=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r11}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:45 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000580)={{0x1, 0x1, 0x18, r1}, './file0\x00'})
r3 = memfd_secret(0x80000)
write$cgroup_int(r3, &(0x7f0000000880)=0x3, 0x12)

01:52:45 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:52:45 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r5 = fork()
sched_setaffinity(r5, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f00000003c0))
r6 = getpid()
sched_setscheduler(r6, 0x1, &(0x7f0000000440)=0x200)

01:52:45 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
r6 = geteuid()
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, r5, 0xffffffffffffffff, r6, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:52:45 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:45 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
write$tcp_mem(r5, &(0x7f0000000480)={0x7fffffff, 0x20, 0x0, 0x20, 0x9}, 0x48)
socket(0x1e, 0x80000, 0xa7)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:52:45 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
semget(0x1, 0x4, 0x5a0)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:45 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
write$tcp_mem(r5, &(0x7f0000000480)={0x7fffffff, 0x20, 0x0, 0x20, 0x9}, 0x48)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:52:45 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:45 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000004c0)={0x1f, 0x0, @fixed}, &(0x7f0000000500)=0xe, 0x800)
r3 = memfd_secret(0x80000)
write$cgroup_int(r3, &(0x7f0000000880)=0x3, 0x12)

01:52:45 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
getresuid(&(0x7f0000000300), &(0x7f0000000340)=<r5=>0x0, &(0x7f0000000380))
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, r5, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:52:45 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r4 = fork()
sched_setaffinity(r4, 0x8, &(0x7f0000000380)=0x7)
ptrace$peekuser(0x3, 0xffffffffffffffff, 0x4)
r5 = getpid()
sched_setscheduler(r5, 0x1, &(0x7f0000000440)=0x200)

01:52:45 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
pipe2$9p(&(0x7f00000027c0)={<r11=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r11}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:45 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000140)=""/203)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:45 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x40200, 0x0)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:52:45 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:52:45 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:45 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
openat$cgroup_type(r2, &(0x7f0000000480), 0x2, 0x0)
r3 = memfd_secret(0x80000)
write$cgroup_int(r3, &(0x7f0000000880)=0x3, 0x12)

01:52:45 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
r4 = shmget$private(0x0, 0x3000, 0x10, &(0x7f0000ffd000/0x3000)=nil)
shmctl$IPC_SET(r4, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:52:45 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
r0 = semget(0x0, 0x3, 0x84)
semctl$GETNCNT(r0, 0x2, 0xe, &(0x7f0000000080)=""/165)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:45 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:52:45 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
semctl$IPC_RMID(0x0, 0x0, 0x0)
pipe2$9p(&(0x7f00000027c0)={<r11=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r11}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:45 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
openat$full(0xffffffffffffff9c, &(0x7f0000000440), 0x10100, 0x0)
r2 = memfd_secret(0x80000)
write$cgroup_int(r2, &(0x7f0000000880)=0x3, 0x12)

[  146.754400] cgroup: fork rejected by pids controller in /syz3
01:52:53 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
semget(0x0, 0x3, 0x84)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:53 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:52:53 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r4 = fork()
sched_setaffinity(r4, 0x8, &(0x7f0000000380)=0x7)
r5 = getpid()
sched_setscheduler(r5, 0x1, &(0x7f0000000440)=0x200)

01:52:53 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
semctl$SEM_INFO(0xffffffffffffffff, 0x3, 0x13, &(0x7f0000001640)=""/4096)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r11=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r11}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:52:53 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_open_dev$mouse(&(0x7f00000002c0), 0x0, 0x40000)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:52:53 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
syz_open_dev$vcsn(&(0x7f00000003c0), 0x5, 0x80000)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:52:53 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000400)=0x9)
r2 = memfd_secret(0x80000)
write$cgroup_int(r2, &(0x7f0000000880)=0x3, 0x12)

01:52:53 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440)={<r3=>0xffffffffffffffff}, 0x800)
fsetxattr$security_evm(r3, &(0x7f0000000480), &(0x7f00000004c0)=@v2={0x3, 0x0, 0x1, 0xffff, 0x9c, "a1438b7f4aac8edf3347128cb1dfcf3f4ca59ff0a20bdb3de62a0162ee97f69cfb6813e65b512c0d802821e1e805520c26cda2c68998803d83c9016cfe0b2f0a1df1bbbba40efd82fd705d8ee7465f65917663a2ff194c0cb53633a7da980cfcd3163f8dd5a898257e86f7eacf97e28ba2fe9bf0f0426eda6c967da8507d244bb61c9ed577716d9d8cdf18fc38b757663ca69ad679d78a50ac40bee5"}, 0xa5, 0x1)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:52:53 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
semtimedop(0xffffffffffffffff, &(0x7f0000000000)=[{0x4, 0xfff, 0x1000}, {0x1, 0x8001, 0x1c00}, {0x3, 0x1, 0x800}, {0x1, 0x2, 0x800}, {0x0, 0xff}, {0x0, 0x9, 0x800}, {0x0, 0x4, 0x1000}], 0x7, &(0x7f0000000040)={0x77359400})
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:52:53 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:01 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2)
r1 = memfd_secret(0x80000)
write$cgroup_int(r1, &(0x7f0000000880)=0x3, 0x12)

01:53:01 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
r10 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
shmctl$SHM_INFO(r10, 0xe, &(0x7f0000001600)=""/64)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r11=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r11}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:01 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
syz_open_dev$mouse(&(0x7f0000000380), 0x2, 0x145500)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:01 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
pipe2$9p(&(0x7f0000000440), 0x800)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:01 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
fork()
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000440)=0x200)

01:53:01 executing program 7:
semctl$IPC_RMID(0xffffffffffffffff, 0x0, 0x0)
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:53:01 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:53:01 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:01 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
syz_open_dev$mouse(&(0x7f00000003c0), 0x9, 0x402800)
r1 = memfd_secret(0x80000)
write$cgroup_int(r1, &(0x7f0000000880)=0x3, 0x12)

01:53:01 executing program 7:
sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000003540))

01:53:01 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:01 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={<r4=>r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_NAME={0x14, 0x2, 'xfrm0\x00'}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x4}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008800}, 0x0)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:01 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000380)=0x1)
r1 = memfd_secret(0x80000)
write$cgroup_int(r1, &(0x7f0000000880)=0x3, 0x12)

01:53:01 executing program 7:
sched_rr_get_interval(0xffffffffffffffff, 0x0)

01:53:10 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x54000, 0x0)
r0 = memfd_secret(0x80000)
write$cgroup_int(r0, &(0x7f0000000880)=0x3, 0x12)

01:53:10 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:53:10 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={r3, 0xffffffffffffffff, 0x7, 0x101})
ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000240))
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:10 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:10 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r10=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:10 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:10 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
openat$vcsu(0xffffffffffffff9c, &(0x7f0000000340), 0x101600, 0x0)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000440)=0x200)

01:53:10 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:10 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:10 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:10 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={<r2=>r1, 0xe26, 0x7ff, 0x9})
r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r3, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={r3, 0xffffffffffffffff, 0x7, 0x101})
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:10 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r10=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:10 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:10 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5)
r0 = memfd_secret(0x80000)
write$cgroup_int(r0, &(0x7f0000000880)=0x3, 0x12)

01:53:10 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000400)=0xb3, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:10 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={<r3=>r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f00000002c0), &(0x7f0000000300)=0x10)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000440)=0x200)

01:53:10 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, &(0x7f0000000300))
r0 = memfd_secret(0x80000)
write$cgroup_int(r0, &(0x7f0000000880)=0x3, 0x12)

[  179.536675] Bluetooth: hci2: command 0x0406 tx timeout
[  179.538442] Bluetooth: hci3: command 0x0406 tx timeout
[  179.539479] Bluetooth: hci0: command 0x0406 tx timeout
[  179.540616] Bluetooth: hci1: command 0x0406 tx timeout
[  179.542389] Bluetooth: hci4: command 0x0406 tx timeout
[  179.543208] Bluetooth: hci6: command 0x0406 tx timeout
[  179.544457] Bluetooth: hci7: command 0x0406 tx timeout
[  179.544653] Bluetooth: hci5: command 0x0406 tx timeout
01:53:20 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000180))
r0 = memfd_secret(0x80000)
write$cgroup_int(r0, &(0x7f0000000880)=0x3, 0x12)

01:53:20 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r10=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:20 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:53:20 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000380), &(0x7f00000003c0)=0xc)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:20 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r1, 0xe26, 0x7ff, 0x9})
r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
epoll_wait(r2, &(0x7f00000001c0)=[{}, {}, {}], 0x3, 0x7)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:20 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={r1, 0x393add15, 0x0, 0x9})
ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x3ff)
r3 = getpid()
sched_setscheduler(r3, 0x1, &(0x7f0000000440)=0x200)

01:53:20 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:20 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:53:20 executing program 6:
ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000000))
r0 = memfd_secret(0x80000)
write$cgroup_int(r0, &(0x7f0000000880)=0x3, 0x12)

01:53:20 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r1, 0xe26, 0x7ff, 0x9})
openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x424202, 0x0)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:20 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000280)={r1, 0x393add15, 0x0, 0x9})
r3 = getpid()
sched_setscheduler(r3, 0x1, &(0x7f0000000440)=0x200)

01:53:20 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:53:20 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:20 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:20 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmctl$SHM_LOCK(0xffffffffffffffff, 0xb)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r10=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:20 executing program 6:
r0 = memfd_secret(0x80000)
write$cgroup_int(r0, &(0x7f0000000880)=0x3, 0x12)

01:53:20 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r1, 0xe26, 0x7ff, 0x9})
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:20 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:20 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
write$cgroup_devices(r2, &(0x7f0000000240)={'a', ' *:* ', 'rw\x00'}, 0x9)
r3 = getpid()
sched_setscheduler(r3, 0x1, &(0x7f0000000440)=0x200)

01:53:20 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400))
r3 = fork()
fork()
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r4 = fork()
kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:53:20 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
r9 = fork()
shmctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f0000001580)={{0x3, r7, 0xffffffffffffffff, 0x0, r0, 0x0, 0x400}, 0x7fff, 0x6, 0x7, 0xbc0, r9})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r10=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:28 executing program 6:
r0 = memfd_secret(0x0)
write$cgroup_int(r0, &(0x7f0000000880)=0x3, 0x12)

01:53:28 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400))
r3 = fork()
fork()
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r4 = fork()
kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:53:28 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r9=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:28 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:28 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:28 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
getsockname$netlink(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0xc)
r3 = getpid()
sched_setscheduler(r3, 0x1, &(0x7f0000000440)=0x200)

01:53:28 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100))
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:28 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:53:28 executing program 6:
memfd_secret(0x0)
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000880)=0x3, 0x12)

01:53:36 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:36 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f00000000c0)=0xe, 0x80000)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:36 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400))
r3 = fork()
fork()
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r4 = fork()
kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:53:36 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:36 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x4000}, 0xc)
r3 = getpid()
sched_setscheduler(r3, 0x1, &(0x7f0000000440)=0x200)

01:53:36 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:36 executing program 6:
memfd_secret(0x0)
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000880)=0x3, 0x12)

01:53:36 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r9=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:36 executing program 1:
write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0x240000000000, 0x20, 0x2, 0x20, 0x9}, 0x48)
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:36 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x103c0, 0x0)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000440)=0x200)

01:53:36 executing program 6:
memfd_secret(0x0)
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000880)=0x3, 0x12)

01:53:36 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:36 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={<r1=>r0, 0x62, 0x9a, 0x9})
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000440)=0x200)

01:53:36 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r9=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:36 executing program 1:
bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000580)={0x1f, 0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xff53, 0x1}, 0xe)

01:53:36 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:36 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:36 executing program 6:
r0 = memfd_secret(0x0)
write$cgroup_int(r0, 0x0, 0x0)

01:53:44 executing program 1:
bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0)

01:53:44 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r9=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:44 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:44 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={r0, 0x62, 0x9a, 0x9})
r1 = getpid()
sched_setscheduler(r1, 0x1, &(0x7f0000000440)=0x200)

01:53:44 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:44 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:44 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, 0x0, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:53:44 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:44 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r9=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:44 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r9=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:44 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:44 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400)=<r7=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r8=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r8, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r9=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r7}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:44 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000440)=0x200)

01:53:44 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:44 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400)=<r5=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[r2])
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r6=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r5}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:44 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:44 executing program 5:
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:45 executing program 5:
shmctl$IPC_SET(0x0, 0x1, 0x0)

01:53:45 executing program 5:
shmctl$IPC_SET(0x0, 0x1, 0x0)

01:53:45 executing program 5:
shmctl$IPC_SET(0x0, 0x1, 0x0)

01:53:53 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000040)='cubic\x00', 0x6)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000440)=0x200)

01:53:53 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, 0x0, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:53:53 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400)=<r5=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r6=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r5}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:53 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:53 executing program 5:
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:53 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:53 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:53:53 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r7=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r7, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0), 0x4000)

01:53:53 executing program 5:
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:53:53 executing program 4:
timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000))
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000440)=0x200)

01:53:53 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400)=<r5=>0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r6=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r5}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:53:53 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:01 executing program 5:
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:01 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r7=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r7, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))

01:54:01 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:01 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)

01:54:01 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:01 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000440)=0x200)

01:54:01 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, 0x0, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:01 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r4=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r3}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:01 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:01 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r4=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r3}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:01 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, <r4=>r2, r2, r2, r0])
getresuid(&(0x7f0000000380)=<r5=>0x0, &(0x7f00000003c0)=<r6=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r6, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[<r7=>r2])
semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000001500)={{0x2, r6, r4, r5, r7, 0x108, 0x1000}, 0x8, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x1})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:01 executing program 4:
getpid()
sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x200)

01:54:01 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:01 executing program 5:
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:01 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:09 executing program 4:
getpid()
sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x200)

01:54:09 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[r2])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:09 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:09 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, 0x0, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(0x0, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:09 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)

01:54:09 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:09 executing program 5:
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x7})

01:54:09 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r4=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt={'fowner<', r3}}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:09 executing program 4:
getpid()
sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x200)

01:54:09 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
getgroups(0x1, &(0x7f00000014c0)=[r2])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:09 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, 0x0, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r4=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:09 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:09 executing program 5:
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7})

01:54:09 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:09 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, &(0x7f0000000440)=0x200)

01:54:09 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:09 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040), &(0x7f0000000080))
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r1=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:09 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:17 executing program 5:
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff}})

01:54:17 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:17 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040), &(0x7f0000000080))
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r1=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:17 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:17 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:17 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000340)=0x14, 0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)

01:54:17 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)

01:54:17 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, 0x0, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(0x0, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:17 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:17 executing program 5:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:17 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040), &(0x7f0000000080))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r1=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:17 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:17 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)

01:54:17 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
getgroups(0x1, &(0x7f00000014c0)=[r2])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:17 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:17 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400))
getgroups(0x1, &(0x7f00000014c0)=[r2])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:17 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)

[  238.684001] cgroup: fork rejected by pids controller in /syz2
01:54:17 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:17 executing program 5:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:17 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, 0x0, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(0x0, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:17 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:17 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[r1, r2, r2, r2, r0])
getgroups(0x1, &(0x7f00000014c0)=[r2])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:17 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:17 executing program 1:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040), &(0x7f0000000080)=<r1=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x1, &(0x7f00000014c0)=[r1])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:17 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, &(0x7f0000000440))

01:54:26 executing program 5:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmctl$IPC_STAT(0x0, 0x2, &(0x7f00000004c0)=""/4096)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:26 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040), &(0x7f0000000080))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r1=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:26 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, 0x0, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:26 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:26 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, &(0x7f0000000440))

01:54:26 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:26 executing program 1:
getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)=<r0=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
getgroups(0x1, &(0x7f00000014c0)=[r0])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:26 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:26 executing program 1:
getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)=<r0=>0x0)
getgroups(0x1, &(0x7f00000014c0)=[r0])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:26 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:26 executing program 5:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[<r3=>r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0)=<r4=>0x0, &(0x7f0000000400))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, r3, r4, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:26 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:26 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, &(0x7f0000000440))

01:54:26 executing program 5:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[r1, r2, r2, r2, r0])
getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400))
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:26 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, 0x0, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:26 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:26 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:36 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:36 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:36 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, 0x0, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:36 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:36 executing program 2:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040), &(0x7f0000000080))
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, r0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r1=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:36 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:36 executing program 1:
getgroups(0x1, &(0x7f00000014c0)=[0x0])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:36 executing program 5:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
getgroups(0x5, &(0x7f00000002c0)=[r1, r2, r2, r2, r0])
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:36 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:36 executing program 1:
getgroups(0x0, 0x0)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:36 executing program 5:
getresgid(&(0x7f0000000000)=<r0=>0x0, &(0x7f0000000040), &(0x7f0000000080))
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
setgid(r0)
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:44 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:44 executing program 2:
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:44 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:44 executing program 1:
getgroups(0x0, 0x0)
shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil)

01:54:44 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:44 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:44 executing program 5:
getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080))
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:44 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:44 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:54:44 executing program 1:
getgroups(0x0, 0x0)
shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil)

01:54:44 executing program 2:
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:44 executing program 5:
getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080))
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:52 executing program 2:
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:52 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:52 executing program 1:
getgroups(0x0, 0x0)
shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil)

01:54:52 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:54:52 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:52 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:52 executing program 5:
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)

01:54:52 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:54:52 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:54:53 executing program 2:
getresgid(0x0, &(0x7f0000000040), &(0x7f0000000080))
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:54:53 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:54:53 executing program 5:
shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil)

01:54:53 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:54:53 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:54:53 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:54:53 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:00 executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:00 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:00 executing program 5:
shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil)

01:55:00 executing program 2:
getresgid(0x0, 0x0, &(0x7f0000000080))
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:00 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:00 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0xc)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:00 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:00 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:01 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:01 executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:01 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:01 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:01 executing program 5:
shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil)

01:55:01 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:01 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:01 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:01 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:10 executing program 2:
getresgid(0x0, 0x0, &(0x7f0000000080))
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:10 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:10 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:10 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:10 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:10 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:10 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:10 executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:10 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:10 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(r2, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:10 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:10 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:10 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:19 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:19 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:19 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:19 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:19 executing program 2:
getresgid(0x0, 0x0, &(0x7f0000000080))
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:19 executing program 0:
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:19 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:19 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:19 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:19 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:19 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:19 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:19 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:19 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:28 executing program 0:
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:28 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:28 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:28 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:28 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:28 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:28 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)

01:55:28 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:28 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:28 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)

01:55:28 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:28 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, 0x0, &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:28 executing program 7:
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:28 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x80000)

01:55:28 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x7fffffff, 0x4)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:28 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:28 executing program 0:
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:28 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:36 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000140)=0x3f, 0x4)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:36 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:36 executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:36 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:36 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:36 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:36 executing program 7:
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:36 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, 0x0, &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:36 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:36 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:36 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:36 executing program 7:
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:36 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:37 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:37 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:37 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:37 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, 0x0, &(0x7f0000000100), 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:37 executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:37 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:37 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
semtimedop(0x0, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(0x0, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:45 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
semtimedop(0x0, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(0x0, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:45 executing program 4:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:45 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:45 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:45 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:45 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:45 executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r0, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:45 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:45 executing program 4:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:45 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:45 executing program 4:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:45 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:45 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:45 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:45 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:45 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, 0x0, &(0x7f0000000040))
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:45 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
semtimedop(0x0, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(0x0, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:45 executing program 4:
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:46 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:46 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:46 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:46 executing program 4:
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:46 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:54 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, 0x0, &(0x7f0000000040))
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:54 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:55:54 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:54 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:55:54 executing program 4:
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:54 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:54 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:54 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:54 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:54 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:54 executing program 4:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:54 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:55:54 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:55:54 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:55:54 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:03 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:03 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:03 executing program 4:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:03 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:03 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:03 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:03 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:03 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, 0x0, &(0x7f0000000040))
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:03 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:03 executing program 4:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:03 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:03 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:03 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:03 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:11 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:11 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:11 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:11 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:11 executing program 1:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:11 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:11 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:11 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:18 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:18 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:18 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:18 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:18 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:18 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:18 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:18 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}, {@loose}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:18 executing program 1:
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:18 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:18 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>0xffffffffffffffff}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:19 executing program 6:
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:19 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:19 executing program 1:
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:19 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>0xffffffffffffffff}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:19 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:19 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:19 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, 0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:19 executing program 1:
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:19 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:19 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:19 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>0xffffffffffffffff}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:19 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:19 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:27 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, 0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:27 executing program 6:
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:27 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
semctl$SETVAL(0x0, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(0x0, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r1 = semget(0x2, 0x3, 0x20)
semtimedop(r1, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r1, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:27 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:27 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:27 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:27 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:27 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:34 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:34 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
semctl$SETVAL(0x0, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(0x0, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r1 = semget(0x2, 0x3, 0x20)
semtimedop(r1, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r1, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:34 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, 0x0)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:34 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, 0x0)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:34 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:34 executing program 6:
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:34 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:34 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:34 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:34 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:34 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, 0x0)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:34 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:34 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r1, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r2 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:34 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0)
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:35 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:35 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:35 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, 0x0)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

[  382.290426] kworker/u10:5 (312) used greatest stack depth: 24048 bytes left
01:56:42 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:42 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:42 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
semctl$SETVAL(0x0, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(0x0, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r1 = semget(0x2, 0x3, 0x20)
semtimedop(r1, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r1, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:42 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:42 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}, {@version_u}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:42 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, &(0x7f0000000180))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:42 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:42 executing program 6:
socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:42 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, &(0x7f0000000180))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:42 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:42 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, &(0x7f0000000180))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:42 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:42 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:42 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:42 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:42 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:51 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:56:51 executing program 6:
socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:51 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:51 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:56:51 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:51 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:51 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:51 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, &(0x7f0000000180))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:51 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x0, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:51 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:51 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:51 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:52 executing program 6:
socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:52 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:56:52 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x0, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:56:52 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x200000, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:56:52 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:00 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}, {@subj_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:00 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:00 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x0, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:00 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:00 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
r0 = semget$private(0x0, 0x1, 0x8)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:57:00 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:00 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:00 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, 0x0, &(0x7f00000000c0))
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:00 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:00 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x0, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:00 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x0, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:00 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, 0x0, &(0x7f00000000c0))
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:00 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0xc)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:07 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x0)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:07 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:07 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, 0x0, &(0x7f00000000c0))
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:07 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(r1, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:07 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:07 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}, {@hash}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:07 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
semctl$SEM_STAT_ANY(0x0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r0 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r0, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r0, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r1 = semget(0x2, 0x3, 0x20)
semtimedop(r1, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(0x0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r1, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:57:07 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x0, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:07 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:07 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x0, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:07 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:07 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:07 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x0)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:07 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:08 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x0, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:08 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:08 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:08 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:08 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:08 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:16 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:16 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
memfd_secret(0x0)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:16 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:16 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), 0x0)
r1 = openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:16 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
semctl$SEM_STAT_ANY(0x0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r0 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r0, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r0, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r1 = semget(0x2, 0x3, 0x20)
semtimedop(r1, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(0x0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r1, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:57:16 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:16 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:16 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x0, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:16 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x0, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:16 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:24 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:24 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), 0x0)
r1 = openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:24 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:24 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x0, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:24 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:24 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
semtimedop(0x0, &(0x7f0000000080)=[{0x4, 0x4, 0x1000}, {0x0, 0xfff, 0x1000}, {0x1, 0x7, 0x800}, {0x1, 0x5, 0x800}, {0x1, 0x1f, 0x800}, {0x1, 0xff, 0x800}], 0x6, &(0x7f00000000c0)={0x77359400})
semctl$SEM_STAT_ANY(0x0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r0 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r0, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r0, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r1 = semget(0x2, 0x3, 0x20)
semtimedop(r1, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(0x0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r2 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r3=>0x0)
r4 = fork()
r5 = fork()
shmctl$IPC_SET(r2, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r3, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r4, r5, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r1, 0x3, 0xb, &(0x7f0000000500)=""/24)
r6 = fork()
kcmp$KCMP_EPOLL_TFD(r4, r6, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:57:24 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x0, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:24 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@appraise_type}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:24 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x0, 0x2, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:24 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:24 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:24 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:24 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x0, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:24 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:24 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x0, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:24 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), 0x0)
r1 = openat$zero(0xffffffffffffff9c, 0x0, 0x2, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:24 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:24 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:24 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:24 executing program 5:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:25 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, 0x0, 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:25 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:57:25 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, 0x0, 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:25 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:25 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:25 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:25 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:33 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, 0x0, 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:33 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x0, 0x352, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:33 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:57:33 executing program 5:
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:33 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:33 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:33 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x352, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:33 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:33 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:33 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:33 executing program 5:
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:33 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

[  434.879562] 
[  434.879745] =====================================
[  434.880150] WARNING: bad unlock balance detected!
[  434.880523] 6.19.0-rc5-next-20260116 #1 Not tainted
[  434.880913] -------------------------------------
[  434.881287] syz-executor.5/11232 is trying to release lock (rcu_read_lock) at:
[  434.881871] [<ffffffff81c1dee5>] __wait_on_freeing_inode+0x105/0x350
[  434.882400] but there are no more locks to release!
[  434.882788] 
[  434.882788] other info that might help us debug this:
[  434.883303] 4 locks held by syz-executor.5/11232:
[  434.883679]  #0: ffff88800f6d23f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400
[  434.884392]  #1: ffff888030d73d10 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400
[  434.885182]  #2: ffff88800f6d6950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0
[  434.886583]  #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890
[  434.888461] 
[  434.888461] stack backtrace:
[  434.889370] CPU: 1 UID: 0 PID: 11232 Comm: syz-executor.5 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) 
[  434.889385] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  434.889392] Call Trace:
[  434.889397]  <TASK>
[  434.889402]  dump_stack_lvl+0xca/0x120
[  434.889433]  ? __wait_on_freeing_inode+0x105/0x350
[  434.889447]  print_unlock_imbalance_bug+0x118/0x130
[  434.889463]  ? __wait_on_freeing_inode+0x105/0x350
[  434.889477]  lock_release+0x1ee/0x270
[  434.889504]  __wait_on_freeing_inode+0x10a/0x350
[  434.889518]  ? __pfx___wait_on_freeing_inode+0x10/0x10
[  434.889534]  ? __pfx_var_wake_function+0x10/0x10
[  434.889551]  ? lock_is_held_type+0x9e/0x120
[  434.889563]  insert_inode_locked+0x25f/0x890
[  434.889580]  __ext4_new_inode+0x223d/0x4cd0
[  434.889597]  ? __pfx___ext4_new_inode+0x10/0x10
[  434.889612]  ? __pfx___dquot_initialize+0x10/0x10
[  434.889631]  ? __pfx_avc_has_perm+0x10/0x10
[  434.889647]  ext4_symlink+0x623/0xb40
[  434.889666]  ? __pfx_ext4_symlink+0x10/0x10
[  434.889682]  ? security_inode_permission+0x72/0xe0
[  434.889695]  vfs_symlink+0x44b/0x840
[  434.889711]  filename_symlinkat+0x158/0x440
[  434.889726]  ? __pfx_filename_symlinkat+0x10/0x10
[  434.889739]  ? strncpy_from_user+0x21b/0x2f0
[  434.889756]  __x64_sys_symlink+0x82/0x110
[  434.889770]  do_syscall_64+0xbf/0x420
[  434.889783]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  434.889796] RIP: 0033:0x7f0119ab3427
[  434.889805] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  434.889816] RSP: 002b:00007ffe0a948718 EFLAGS: 00000206 ORIG_RAX: 0000000000000058
[  434.889827] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0119ab3427
[  434.889835] RDX: 00007ffe0a9487f7 RSI: 00007f0119b0e019 RDI: 00007ffe0a9487e0
[  434.889843] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffe0a9485b0
[  434.889850] R10: 00007ffe0a948467 R11: 0000000000000206 R12: 0000000000000001
[  434.889857] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffe0a9487e0
[  434.889867]  </TASK>
[  434.908651] ------------[ cut here ]------------
[  434.924096] WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#1: syz-executor.5/11232
[  434.942309] Modules linked in:
[  434.942617] CPU: 1 UID: 0 PID: 11232 Comm: syz-executor.5 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) 
[  434.961671] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  434.993118] RIP: 0010:__rcu_read_unlock+0x25f/0x5c0
[  434.993608] Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9
[  435.021399] RSP: 0018:ffff888045f779a0 EFLAGS: 00010286
[  435.021843] RAX: 00000000ffffffff RBX: ffff88803e305280 RCX: ffffffff815660f7
[  435.040700] RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff88803e30567c
[  435.059621] RBP: ffff88803e305280 R08: 0000000000000000 R09: fffffbfff0ba7040
[  435.080534] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88803e305280
[  435.100200] R13: 0000000000000001 R14: ffffffff85c0d650 R15: ffff888030d558e0
[  435.100879] FS:  0000555568623400(0000) GS:ffff8880e5442000(0000) knlGS:0000000000000000
[  435.121724] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  435.137300] CR2: 00007f0119b33545 CR3: 000000001f25a000 CR4: 0000000000350ef0
[  435.137872] Call Trace:
[  435.155519]  <TASK>
[  435.178424]  __wait_on_freeing_inode+0x10f/0x350
[  435.217374]  ? __pfx___wait_on_freeing_inode+0x10/0x10
[  435.254991]  ? __pfx_var_wake_function+0x10/0x10
[  435.256262]  ? lock_is_held_type+0x9e/0x120
[  435.257374]  insert_inode_locked+0x25f/0x890
[  435.259050]  __ext4_new_inode+0x223d/0x4cd0
[  435.261516]  ? __pfx___ext4_new_inode+0x10/0x10
[  435.262748]  ? __pfx___dquot_initialize+0x10/0x10
[  435.263539]  ? __pfx_avc_has_perm+0x10/0x10
[  435.265318]  ext4_symlink+0x623/0xb40
[  435.267566]  ? __pfx_ext4_symlink+0x10/0x10
[  435.268567]  ? security_inode_permission+0x72/0xe0
[  435.270242]  vfs_symlink+0x44b/0x840
[  435.271507]  filename_symlinkat+0x158/0x440
[  435.272623]  ? __pfx_filename_symlinkat+0x10/0x10
[  435.273382]  ? strncpy_from_user+0x21b/0x2f0
[  435.275249]  __x64_sys_symlink+0x82/0x110
[  435.275995]  do_syscall_64+0xbf/0x420
[  435.276763]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  435.277304] RIP: 0033:0x7f0119ab3427
[  435.277670] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  435.279137] RSP: 002b:00007ffe0a948718 EFLAGS: 00000206 ORIG_RAX: 0000000000000058
[  435.279734] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0119ab3427
[  435.280337] RDX: 00007ffe0a9487f7 RSI: 00007f0119b0e019 RDI: 00007ffe0a9487e0
[  435.280939] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffe0a9485b0
[  435.281512] R10: 00007ffe0a948467 R11: 0000000000000206 R12: 0000000000000001
[  435.282120] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffe0a9487e0
[  435.284761]  </TASK>
[  435.284996] irq event stamp: 171
[  435.285272] hardirqs last  enabled at (171): [<ffffffff84d19a7c>] _raw_spin_unlock_irqrestore+0x2c/0x50
[  435.286128] hardirqs last disabled at (170): [<ffffffff84d197d3>] _raw_spin_lock_irqsave+0x53/0x60
[  435.286951] softirqs last  enabled at (166): [<ffffffff812cda79>] kernel_fpu_end+0x59/0x70
[  435.287666] softirqs last disabled at (164): [<ffffffff812ce94b>] kernel_fpu_begin_mask+0x1bb/0x300
[  435.288493] ---[ end trace 0000000000000000 ]---
01:57:34 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:34 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:34 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:41 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, 0x0, &(0x7f00000000c0))
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:41 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, 0x0, &(0x7f00000002c0))
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:41 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
r1 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:41 executing program 5:
syz_io_uring_setup(0x306d, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:41 executing program 1:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
getpeername$netlink(0xffffffffffffffff, 0x0, 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r0 = memfd_secret(0x0)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:41 executing program 3:
semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000000)=""/74)
r0 = semget$private(0x0, 0x1, 0x8)
semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000100)=""/98)
r1 = semget(0x3, 0x1, 0x280)
semctl$SETVAL(r1, 0x4, 0x10, &(0x7f0000000180)=0x9)
semctl$SETVAL(r1, 0x2, 0x10, &(0x7f00000001c0)=0x3)
r2 = semget(0x2, 0x3, 0x20)
semtimedop(r2, &(0x7f0000000200)=[{0x4, 0x188, 0x1000}], 0x1, &(0x7f0000000240)={0x0, 0x3938700})
semctl$GETVAL(r0, 0x3, 0xc, &(0x7f0000000280)=""/199)
r3 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffd000/0x2000)=nil)
getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)=<r4=>0x0)
r5 = fork()
r6 = fork()
shmctl$IPC_SET(r3, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0xffffffffffffffff, r4, 0x80, 0x8000}, 0x6, 0x6, 0x5, 0x93, r5, r6, 0xf000})
semctl$SEM_INFO(0xffffffffffffffff, 0x1, 0x13, &(0x7f00000004c0)=""/55)
semctl$GETPID(r2, 0x3, 0xb, &(0x7f0000000500)=""/24)
r7 = fork()
kcmp$KCMP_EPOLL_TFD(r5, r7, 0x7, 0xffffffffffffffff, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x6})

01:57:41 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@smackfshat={'smackfshat', 0x3d, '*\''}}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:41 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x0, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)

01:57:41 executing program 2:
getresgid(0x0, &(0x7f0000000040), 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2008, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@aname={'aname', 0x3d, '\\\'\\:*$'}}], [{@pcr={'pcr', 0x3d, 0x24}}, {@fowner_eq={'fowner', 0x3d, 0xee00}}, {@obj_type}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, ']'}}]}})
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000440)={{0x0, 0xee01, 0x0, 0x0, 0x0, 0x14, 0x6e}, 0x9, 0x0, 0x4, 0x9, 0xffffffffffffffff, 0x0, 0xabd8})
fork()
shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffb000/0x4000)=nil)
getresgid(&(0x7f0000002640), &(0x7f0000002680), &(0x7f00000026c0))
pipe2$9p(&(0x7f00000027c0)={<r0=>0xffffffffffffffff}, 0x4000)
mount$9p_fd(0x0, &(0x7f0000002740)='./file0\x00', &(0x7f0000002780), 0x48000, &(0x7f0000002ac0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {}, 0x2c, {[{@dfltuid}, {@cache_fscache}, {@version_9p2000}], [{@appraise_type}, {@dont_appraise}, {@fowner_lt}, {@euid_eq}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x35, 0x61, 0x61, 0x63, 0x31, 0x63], 0x2d, [0x63, 0x0, 0x31, 0x32], 0x2d, [0x38, 0x37, 0x31, 0x61], 0x2d, [0x30, 0x65, 0x65, 0x39], 0x2d, [0x5b, 0x61, 0x63, 0x38, 0x35, 0x31, 0x63, 0x30]}}}, {@subj_user={'subj_user', 0x3d, '{'}}]}})

01:57:41 executing program 4:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f00000000c0))
memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x0, 0x352}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

01:57:41 executing program 5:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_io_uring_setup(0x0, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))

01:57:41 executing program 7:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0xffffffffffffffc0)
ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0}, './file0\x00'})
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x80, 0x9, 0x80000001, 0x1fa6}, 0x10)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0)
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x100280, 0x0)
getpeername$netlink(r2, &(0x7f0000000140), &(0x7f0000000180)=0xc)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
r3 = memfd_secret(0x80000)
syz_io_uring_setup(0x306d, &(0x7f00000001c0)={0x0, 0x2a99, 0x1, 0x2, 0x352, 0x0, r3}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280))
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x89, 0x90}, 0x7, 0x7, 0xfffffffffffffff9, 0x8000, 0x0, 0x0, 0x7})

01:57:41 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getpeername$netlink(r0, &(0x7f0000000080), 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, 0x0, &(0x7f00000002c0))
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0)
openat$sr(0xffffffffffffff9c, &(0x7f0000000580), 0x800, 0x0)
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000640), 0x40000, 0x0)


VM DIAGNOSIS:
01:57:33  Registers:
info registers vcpu 0
RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84d1a2ce RDX=fffffbfff0b82d11
RSI=0000000000000004 RDI=ffffffff85c16880 RBP=ffffffff85c16880 RSP=ffff88801adcfb40
R8 =0000000000000000 R9 =fffffbfff0b82d10 R10=ffffffff85c16883 R11=0000000000000000
R12=1ffff110035b9f69 R13=0000000000000003 R14=fffffbfff0b82d10 R15=ffff88801adcfb78
RIP=ffffffff84d1a460 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 000055558bb6c400 00000000 00000000
GS =0000 ffff8880e5342000 00000000 00000000
LDT=0000 fffffe7c00000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffdf920dfd8 CR3=000000000b4c8000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11
XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000
XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=ffffffff829750a0 RDI=ffffffff889c19e0 RBP=ffffffff889c19a0 RSP=ffff88806cf088e0
R8 =0000000000000000 R9 =ffffed10013c9046 R10=00000000000fe503 R11=6572617764726148
R12=0000000000000823 R13=0000000000000020 R14=fffffbfff113838e R15=dffffc0000000000
RIP=ffffffff829750f5 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000555568623400 00000000 00000000
GS =0000 ffff8880e5442000 00000000 00000000
LDT=0000 fffffe3300000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f0119b33545 CR3=000000001f25a000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000a60ce07b00000000cec3662e XMM01=000000000000000003515b82db34ca11
XMM02=0000000000000000333bebdfd0a6a21d XMM03=00000000000000000000000000000000
XMM04=000000ff0000000000000000000000ff XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000