Warning: Permanently added '[localhost]:20828' (ECDSA) to the list of known hosts.
2022/09/30 07:02:13 fuzzer started
2022/09/30 07:02:13 dialing manager at localhost:40535
syzkaller login: [   36.271673] cgroup: Unknown subsys name 'net'
[   36.360260] cgroup: Unknown subsys name 'rlimit'
2022/09/30 07:02:28 syscalls: 204
2022/09/30 07:02:28 code coverage: enabled
2022/09/30 07:02:28 comparison tracing: enabled
2022/09/30 07:02:28 extra coverage: enabled
2022/09/30 07:02:28 setuid sandbox: enabled
2022/09/30 07:02:28 namespace sandbox: enabled
2022/09/30 07:02:28 Android sandbox: enabled
2022/09/30 07:02:28 fault injection: enabled
2022/09/30 07:02:28 leak checking: enabled
2022/09/30 07:02:28 net packet injection: enabled
2022/09/30 07:02:28 net device setup: enabled
2022/09/30 07:02:28 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2022/09/30 07:02:28 devlink PCI setup: PCI device 0000:00:10.0 is not available
2022/09/30 07:02:28 USB emulation: enabled
2022/09/30 07:02:28 hci packet injection: enabled
2022/09/30 07:02:28 wifi device emulation: failed to parse kernel version (6.0.0-rc7-next-20220929������������������������������������������)
2022/09/30 07:02:28 802.15.4 emulation: enabled
2022/09/30 07:02:28 fetching corpus: 0, signal 0/0 (executing program)
2022/09/30 07:02:29 starting 8 fuzzer processes
07:02:29 executing program 0:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10)
socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0)
ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640))
setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4)
pipe2$9p(&(0x7f00000006c0), 0x80000)
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}})
ioctl$TIOCNXCL(r4, 0x540d)
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'})
openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0)
ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0))
ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000001800)=""/205)

07:02:29 executing program 1:
write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24)
r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7)
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0)
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4)
r2 = socket$inet_icmp(0x2, 0x2, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', <r3=>0x0})
r4 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCMIWAIT(r4, 0x545c, 0x0)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0)
ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580))
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e})
socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
bind$packet(r7, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14)
connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14)
ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0))
ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f0000000700)={0x8, 'team0\x00', {'veth0_macvtap\x00'}, 0xff})
socket$packet(0x11, 0x3, 0x300)

07:02:29 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]})
r3 = syz_open_pts(r1, 0x181280)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"})
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)
ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1})
sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044094}, 0x0)

07:02:29 executing program 4:
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0)
openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0)
r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0)
ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100))
r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0)
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0)
ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7})
ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240))
r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=<r5=>0x0, &(0x7f0000000500)=<r6=>0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58)
clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=<r7=>0x0, &(0x7f0000000300)=<r8=>0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=<r9=>0x0)
clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=<r10=>0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58)
clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58)
r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00))
r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]})
ioctl$TIOCGSOFTCAR(r12, 0x5419, &(0x7f00000010c0))

07:02:29 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0)
r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0))

[   51.700803] audit: type=1400 audit(1664521349.779:6): avc:  denied  { execmem } for  pid=286 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
07:02:29 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]})
semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208)
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r3, 0x4b36)

07:02:29 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8})
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})
ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240))
r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000)
setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000012c0)={0x0, 0x1, 0x6, @random="beeef6bfef05"}, 0x10)

07:02:29 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff})
pidfd_open(0xffffffffffffffff, 0x0)
r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0)
openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000001d00), 0x4202, 0x0)
write$snapshot(r6, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

[   52.904280] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   52.906305] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   52.908615] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   52.909826] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   52.911760] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   52.912982] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   52.917767] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   52.919049] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   52.923175] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[   52.924400] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   52.926798] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   52.928117] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   52.936315] Bluetooth: hci1: HCI_REQ-0x0c1a
[   52.938304] Bluetooth: hci0: HCI_REQ-0x0c1a
[   53.000380] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   53.004234] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   53.005771] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   53.026810] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   53.028398] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[   53.030190] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[   53.032643] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   53.035822] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   53.036840] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[   53.037837] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[   53.039587] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[   53.041252] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   53.043326] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[   53.044468] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   53.045861] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[   53.058401] Bluetooth: hci2: HCI_REQ-0x0c1a
[   53.060125] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[   53.065127] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[   53.067338] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[   53.074744] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   53.088915] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[   53.090581] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[   53.092081] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[   53.093582] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[   53.098635] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   53.108332] Bluetooth: hci6: HCI_REQ-0x0c1a
[   53.109662] Bluetooth: hci5: HCI_REQ-0x0c1a
[   53.111525] Bluetooth: hci7: HCI_REQ-0x0c1a
[   54.990006] Bluetooth: hci4: Opcode 0x c03 failed: -110
[   54.991694] Bluetooth: hci0: command 0x0409 tx timeout
[   54.992270] Bluetooth: hci1: command 0x0409 tx timeout
[   54.994910] Bluetooth: hci3: Opcode 0x c03 failed: -110
[   55.117970] Bluetooth: hci7: command 0x0409 tx timeout
[   55.118696] Bluetooth: hci5: command 0x0409 tx timeout
[   55.119209] Bluetooth: hci2: command 0x0409 tx timeout
[   55.183090] Bluetooth: hci6: command 0x0409 tx timeout
[   57.038004] Bluetooth: hci0: command 0x041b tx timeout
[   57.038844] Bluetooth: hci1: command 0x041b tx timeout
[   57.166025] Bluetooth: hci2: command 0x041b tx timeout
[   57.166773] Bluetooth: hci5: command 0x041b tx timeout
[   57.167491] Bluetooth: hci7: command 0x041b tx timeout
[   57.230027] Bluetooth: hci6: command 0x041b tx timeout
[   57.936531] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   57.937849] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   57.939366] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   57.941377] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   57.942674] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[   57.943595] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   57.956953] Bluetooth: hci3: HCI_REQ-0x0c1a
[   59.085961] Bluetooth: hci1: command 0x040f tx timeout
[   59.086022] Bluetooth: hci0: command 0x040f tx timeout
[   59.214155] Bluetooth: hci7: command 0x040f tx timeout
[   59.214183] Bluetooth: hci5: command 0x040f tx timeout
[   59.215070] Bluetooth: hci2: command 0x040f tx timeout
[   59.277970] Bluetooth: hci6: command 0x040f tx timeout
[   59.982073] Bluetooth: hci3: command 0x0409 tx timeout
[   60.173966] Bluetooth: hci4: Opcode 0x c03 failed: -110
[   61.133999] Bluetooth: hci1: command 0x0419 tx timeout
[   61.134447] Bluetooth: hci0: command 0x0419 tx timeout
[   61.261932] Bluetooth: hci5: command 0x0419 tx timeout
[   61.262390] Bluetooth: hci7: command 0x0419 tx timeout
[   61.262945] Bluetooth: hci2: command 0x0419 tx timeout
[   61.326925] Bluetooth: hci6: command 0x0419 tx timeout
[   62.029944] Bluetooth: hci3: command 0x041b tx timeout
[   64.077926] Bluetooth: hci3: command 0x040f tx timeout
[   64.654938] Bluetooth: hci4: Opcode 0x c03 failed: -110
[   66.125914] Bluetooth: hci3: command 0x0419 tx timeout
[   67.047270] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   67.069416] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   67.074385] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   67.092142] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   67.094423] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[   67.096449] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   67.101401] Bluetooth: hci4: HCI_REQ-0x0c1a
[   69.134950] Bluetooth: hci4: command 0x0409 tx timeout
[   71.182973] Bluetooth: hci4: command 0x041b tx timeout
[   73.229938] Bluetooth: hci4: command 0x040f tx timeout
[   75.278927] Bluetooth: hci4: command 0x0419 tx timeout
07:03:19 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff})
pidfd_open(0xffffffffffffffff, 0x0)
r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0)
openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000001d00), 0x4202, 0x0)
write$snapshot(r6, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:03:20 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff})
pidfd_open(0xffffffffffffffff, 0x0)
r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0)
openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000001d00), 0x4202, 0x0)
write$snapshot(r6, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:03:39 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]})
semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208)
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r3, 0x4b36)

07:03:39 executing program 0:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10)
socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0)
ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640))
setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4)
pipe2$9p(&(0x7f00000006c0), 0x80000)
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}})
ioctl$TIOCNXCL(r4, 0x540d)
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'})
openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0)
ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0))
ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000001800)=""/205)

07:03:39 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8})
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})
ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240))
r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000)
setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000012c0)={0x0, 0x1, 0x6, @random="beeef6bfef05"}, 0x10)

07:03:39 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]})
r3 = syz_open_pts(r1, 0x181280)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"})
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)
ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1})
sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044094}, 0x0)

07:03:39 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff})
pidfd_open(0xffffffffffffffff, 0x0)
r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0)
openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0)
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000001d00), 0x4202, 0x0)
write$snapshot(r6, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:03:39 executing program 1:
write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24)
r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7)
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0)
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4)
r2 = socket$inet_icmp(0x2, 0x2, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', <r3=>0x0})
r4 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCMIWAIT(r4, 0x545c, 0x0)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0)
ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580))
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e})
socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
bind$packet(r7, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14)
connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14)
ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0))
ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f0000000700)={0x8, 'team0\x00', {'veth0_macvtap\x00'}, 0xff})
socket$packet(0x11, 0x3, 0x300)

07:03:39 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0)
r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0))

07:03:39 executing program 4:
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0)
openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0)
r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0)
ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100))
r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0)
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0)
ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7})
ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240))
r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=<r5=>0x0, &(0x7f0000000500)=<r6=>0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58)
clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=<r7=>0x0, &(0x7f0000000300)=<r8=>0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=<r9=>0x0)
clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=<r10=>0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58)
clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58)
r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00))
r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]})
ioctl$TIOCGSOFTCAR(r12, 0x5419, &(0x7f00000010c0))

07:03:39 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff})
pidfd_open(0xffffffffffffffff, 0x0)
r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0)
openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:03:39 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff})
pidfd_open(0xffffffffffffffff, 0x0)
openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:03:39 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8})
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})
ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240))
r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000)
setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000012c0)={0x0, 0x1, 0x6, @random="beeef6bfef05"}, 0x10)

07:03:39 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff})
pidfd_open(0xffffffffffffffff, 0x0)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:03:39 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]})
semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208)
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r3, 0x4b36)

07:03:39 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]})
r3 = syz_open_pts(r1, 0x181280)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"})
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)
ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1})
sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044094}, 0x0)

07:03:39 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff})
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:03:39 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8})
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})
ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240))
r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000)
setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000012c0)={0x0, 0x1, 0x6, @random="beeef6bfef05"}, 0x10)

07:03:51 executing program 0:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10)
socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0)
ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640))
setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4)
pipe2$9p(&(0x7f00000006c0), 0x80000)
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}})
ioctl$TIOCNXCL(r4, 0x540d)
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'})
openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0)
ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0))
ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000001800)=""/205)

07:03:51 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0)
r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0))

07:03:51 executing program 1:
write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24)
r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7)
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0)
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4)
r2 = socket$inet_icmp(0x2, 0x2, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', <r3=>0x0})
r4 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCMIWAIT(r4, 0x545c, 0x0)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0)
ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580))
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e})
socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
bind$packet(r7, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14)
connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14)
ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0))
ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f0000000700)={0x8, 'team0\x00', {'veth0_macvtap\x00'}, 0xff})
socket$packet(0x11, 0x3, 0x300)

07:03:51 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]})
r3 = syz_open_pts(r1, 0x181280)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"})
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)
ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1})
sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044094}, 0x0)

07:03:51 executing program 4:
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0)
openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0)
r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0)
ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100))
r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0)
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0)
ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7})
ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240))
r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=<r5=>0x0, &(0x7f0000000500)=<r6=>0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58)
clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=<r7=>0x0, &(0x7f0000000300)=<r8=>0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=<r9=>0x0)
clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=<r10=>0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58)
clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58)
r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00))
r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]})
ioctl$TIOCGSOFTCAR(r12, 0x5419, &(0x7f00000010c0))

07:03:51 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]})
semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208)
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r3, 0x4b36)

07:03:51 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8})
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})
ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240))
accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000)

07:03:51 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:05 executing program 1:
write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24)
r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7)
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0)
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4)
r2 = socket$inet_icmp(0x2, 0x2, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', <r3=>0x0})
r4 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCMIWAIT(r4, 0x545c, 0x0)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0)
ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580))
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e})
socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
bind$packet(r7, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14)
connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14)
ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0))
ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f0000000700)={0x8, 'team0\x00', {'veth0_macvtap\x00'}, 0xff})
socket$packet(0x11, 0x3, 0x300)

07:04:05 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8})
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})
ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240))

07:04:05 executing program 0:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10)
socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0)
ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640))
setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4)
pipe2$9p(&(0x7f00000006c0), 0x80000)
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}})
ioctl$TIOCNXCL(r4, 0x540d)
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'})
openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0)
ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0))
ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000001800)=""/205)

07:04:05 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:05 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]})
r3 = syz_open_pts(r1, 0x181280)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"})
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)
ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1})

07:04:05 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]})
semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208)
ioctl$KDENABIO(0xffffffffffffffff, 0x4b36)

07:04:05 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0)
r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0))

07:04:05 executing program 4:
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0)
openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0)
r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0)
ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100))
r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0)
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0)
ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7})
ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240))
r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=<r5=>0x0, &(0x7f0000000500)=<r6=>0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58)
clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=<r7=>0x0, &(0x7f0000000300)=<r8=>0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=<r9=>0x0)
clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=<r10=>0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58)
clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58)
r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00))
r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]})
ioctl$TIOCGSOFTCAR(r12, 0x5419, &(0x7f00000010c0))

07:04:05 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:05 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8})
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:05 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80))
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:05 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:05 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]})
semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208)
ioctl$KDENABIO(0xffffffffffffffff, 0x4b36)

07:04:05 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r5, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180))
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:05 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, <r3=>0x0})
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]})
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:05 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]})
r3 = syz_open_pts(r1, 0x181280)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"})
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)

07:04:17 executing program 1:
write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24)
r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7)
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0)
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4)
r2 = socket$inet_icmp(0x2, 0x2, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', <r3=>0x0})
r4 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCMIWAIT(r4, 0x545c, 0x0)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0)
ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580))
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e})
socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
bind$packet(r6, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14)
connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14)
ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0))
socket$packet(0x11, 0x3, 0x300)

07:04:17 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880))
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:17 executing program 4:
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0)
openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0)
r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0)
ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100))
r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0)
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0)
ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7})
ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240))
r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=<r5=>0x0, &(0x7f0000000500)=<r6=>0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58)
clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=<r7=>0x0, &(0x7f0000000300)=<r8=>0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=<r9=>0x0)
clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=<r10=>0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58)
clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58)
r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00))
r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0)
ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]})

07:04:17 executing program 0:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10)
socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0)
ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640))
setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4)
pipe2$9p(&(0x7f00000006c0), 0x80000)
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}})
ioctl$TIOCNXCL(r4, 0x540d)
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'})
openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0)
ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0))

07:04:17 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0)
r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080)

07:04:17 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r4, 0x4b36)
read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:17 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]})
syz_open_pts(r1, 0x181280)
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)

07:04:17 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]})
semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208)
ioctl$KDENABIO(0xffffffffffffffff, 0x4b36)

07:04:17 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:17 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]})
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r3, 0x4b36)

07:04:17 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$KDENABIO(r4, 0x4b36)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:17 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0)
r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080)

07:04:17 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:17 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]})
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)

07:04:18 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=<r2=>0x0)
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56)
r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r3, 0x4b36)

07:04:18 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:30 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440))
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r2, 0x4b36)

07:04:30 executing program 1:
write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24)
r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7)
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0)
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4)
r2 = socket$inet_icmp(0x2, 0x2, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', <r3=>0x0})
r4 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCMIWAIT(r4, 0x545c, 0x0)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0)
ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580))
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e})
socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
bind$packet(r6, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14)
connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14)
ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0))
socket$packet(0x11, 0x3, 0x300)

07:04:30 executing program 0:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10)
socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0)
ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640))
setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4)
pipe2$9p(&(0x7f00000006c0), 0x80000)
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}})
ioctl$TIOCNXCL(r4, 0x540d)
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'})
openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0)

07:04:30 executing program 4:
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0)
openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0)
r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0)
ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100))
r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0)
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0)
ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7})
ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240))
r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=<r5=>0x0, &(0x7f0000000500)=<r6=>0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58)
clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=<r7=>0x0, &(0x7f0000000300)=<r8=>0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=<r9=>0x0)
clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=<r10=>0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58)
clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58)
r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00))
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0)

07:04:30 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:30 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
getitimer(0x0, &(0x7f00000006c0))
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)

07:04:30 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TIOCGPTPEER(r3, 0x5441, 0x5)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:30 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0)
r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080)

07:04:31 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:31 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:31 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0)
syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0))

07:04:31 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=<r1=>0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
pidfd_open(r1, 0x0)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r2, 0x4b36)

07:04:31 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10)
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)

07:04:31 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0))
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:31 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:31 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280), {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r1, 0x4b36)

07:04:31 executing program 0:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10)
socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0)
ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640))
setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4)
pipe2$9p(&(0x7f00000006c0), 0x80000)
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}})
ioctl$TIOCNXCL(r4, 0x540d)
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0)

[  175.565977] Bluetooth: hci1: command 0x0406 tx timeout
[  175.566154] Bluetooth: hci0: command 0x0406 tx timeout
[  175.566423] Bluetooth: hci2: command 0x0406 tx timeout
[  175.567350] Bluetooth: hci7: command 0x0406 tx timeout
[  175.567686] Bluetooth: hci6: command 0x0406 tx timeout
[  175.568544] Bluetooth: hci5: command 0x0406 tx timeout
[  179.150000] INFO: task rcu_gp:3 blocked for more than 142 seconds.
[  179.151246]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.152187] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.153451] task:rcu_gp          state:I stack:30328 pid:3     ppid:2      flags:0x00004000
[  179.155683] Call Trace:
[  179.156611]  <TASK>
[  179.157063]  __schedule+0x893/0x2470
[  179.157752]  ? io_schedule_timeout+0x150/0x150
[  179.158581]  ? do_raw_spin_lock+0x121/0x260
[  179.159395]  ? rwlock_bug.part.0+0x90/0x90
[  179.160164]  schedule+0xda/0x1b0
[  179.160769]  rescuer_thread+0x851/0xdb0
[  179.161498]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.162376]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.163293]  ? lockdep_hardirqs_on+0x79/0x100
[  179.164047]  ? worker_thread+0x1260/0x1260
[  179.164651]  kthread+0x2ed/0x3a0
[  179.165165]  ? kthread_complete_and_exit+0x40/0x40
[  179.165856]  ret_from_fork+0x22/0x30
[  179.166440]  </TASK>
[  179.166770] INFO: task rcu_par_gp:4 blocked for more than 142 seconds.
[  179.167687]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.168445] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.169505] task:rcu_par_gp      state:I stack:30944 pid:4     ppid:2      flags:0x00004000
[  179.170649] Call Trace:
[  179.171027]  <TASK>
[  179.171368]  __schedule+0x893/0x2470
[  179.171920]  ? io_schedule_timeout+0x150/0x150
[  179.172537]  ? do_raw_spin_lock+0x121/0x260
[  179.173149]  ? rwlock_bug.part.0+0x90/0x90
[  179.173745]  schedule+0xda/0x1b0
[  179.174246]  rescuer_thread+0x851/0xdb0
[  179.174795]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.175498]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.176196]  ? lockdep_hardirqs_on+0x79/0x100
[  179.176809]  ? worker_thread+0x1260/0x1260
[  179.177414]  kthread+0x2ed/0x3a0
[  179.177904]  ? kthread_complete_and_exit+0x40/0x40
[  179.178566]  ret_from_fork+0x22/0x30
[  179.179128]  </TASK>
[  179.179471] INFO: task slub_flushwq:5 blocked for more than 142 seconds.
[  179.180373]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.181092] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.182109] task:slub_flushwq    state:I stack:30944 pid:5     ppid:2      flags:0x00004000
[  179.183229] Call Trace:
[  179.183578]  <TASK>
[  179.183918]  __schedule+0x893/0x2470
[  179.184463]  ? io_schedule_timeout+0x150/0x150
[  179.185127]  ? do_raw_spin_lock+0x121/0x260
[  179.185741]  ? rwlock_bug.part.0+0x90/0x90
[  179.186373]  schedule+0xda/0x1b0
[  179.186889]  rescuer_thread+0x851/0xdb0
[  179.187467]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.188188]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.188913]  ? lockdep_hardirqs_on+0x79/0x100
[  179.189556]  ? worker_thread+0x1260/0x1260
[  179.190203]  kthread+0x2ed/0x3a0
[  179.190691]  ? kthread_complete_and_exit+0x40/0x40
[  179.191491]  ret_from_fork+0x22/0x30
[  179.192068]  </TASK>
[  179.192403] INFO: task netns:6 blocked for more than 142 seconds.
[  179.193263]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.194021] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.195087] task:netns           state:I stack:30944 pid:6     ppid:2      flags:0x00004000
[  179.196264] Call Trace:
[  179.196627]  <TASK>
[  179.196984]  __schedule+0x893/0x2470
[  179.197526]  ? io_schedule_timeout+0x150/0x150
[  179.198188]  ? do_raw_spin_lock+0x121/0x260
[  179.198806]  ? rwlock_bug.part.0+0x90/0x90
[  179.199449]  schedule+0xda/0x1b0
[  179.199970]  rescuer_thread+0x851/0xdb0
[  179.200539]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.201260]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.201988]  ? lockdep_hardirqs_on+0x79/0x100
[  179.202631]  ? worker_thread+0x1260/0x1260
[  179.203265]  kthread+0x2ed/0x3a0
[  179.203754]  ? kthread_complete_and_exit+0x40/0x40
[  179.204465]  ret_from_fork+0x22/0x30
[  179.205040]  </TASK>
[  179.205375] INFO: task kworker/0:0H:8 blocked for more than 142 seconds.
[  179.206311]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.207067] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.208183] task:kworker/0:0H    state:I stack:28952 pid:8     ppid:2      flags:0x00004000
[  179.209355] Workqueue:  0x0 (kblockd)
[  179.209925] Call Trace:
[  179.210285]  <TASK>
[  179.210615]  __schedule+0x893/0x2470
[  179.211190]  ? io_schedule_timeout+0x150/0x150
[  179.211860]  schedule+0xda/0x1b0
[  179.212379]  worker_thread+0x15f/0x1260
[  179.213022]  ? process_one_work+0x16a0/0x16a0
[  179.213673]  kthread+0x2ed/0x3a0
[  179.214206]  ? kthread_complete_and_exit+0x40/0x40
[  179.214928]  ret_from_fork+0x22/0x30
[  179.215507]  </TASK>
[  179.215838] INFO: task mm_percpu_wq:10 blocked for more than 142 seconds.
[  179.216777]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.217536] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.218610] task:mm_percpu_wq    state:I stack:30944 pid:10    ppid:2      flags:0x00004000
[  179.219787] Call Trace:
[  179.220176]  <TASK>
[  179.220505]  __schedule+0x893/0x2470
[  179.221076]  ? io_schedule_timeout+0x150/0x150
[  179.221720]  ? do_raw_spin_lock+0x121/0x260
[  179.222351]  ? rwlock_bug.part.0+0x90/0x90
[  179.223000]  schedule+0xda/0x1b0
[  179.223497]  rescuer_thread+0x851/0xdb0
[  179.224097]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.224801]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.225529]  ? lockdep_hardirqs_on+0x79/0x100
[  179.226194]  ? worker_thread+0x1260/0x1260
[  179.226790]  kthread+0x2ed/0x3a0
[  179.227331]  ? kthread_complete_and_exit+0x40/0x40
[  179.228046]  ret_from_fork+0x22/0x30
[  179.228610]  </TASK>
[  179.228976] INFO: task rcu_tasks_kthre:11 blocked for more than 143 seconds.
[  179.229961]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.230691] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.231779] task:rcu_tasks_kthre state:I stack:29272 pid:11    ppid:2      flags:0x00004000
[  179.232943] Call Trace:
[  179.233307]  <TASK>
[  179.233633]  __schedule+0x893/0x2470
[  179.234202]  ? io_schedule_timeout+0x150/0x150
[  179.234856]  ? mark_held_locks+0x9e/0xe0
[  179.235474]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.236212]  schedule+0xda/0x1b0
[  179.236704]  rcu_tasks_one_gp+0x3db/0xc10
[  179.237357]  rcu_tasks_kthread+0x80/0xa0
[  179.237969]  ? rcu_tasks_postscan+0x10/0x10
[  179.238580]  kthread+0x2ed/0x3a0
[  179.239099]  ? kthread_complete_and_exit+0x40/0x40
[  179.239819]  ret_from_fork+0x22/0x30
[  179.240400]  </TASK>
[  179.240738] INFO: task kworker/1:0H:21 blocked for more than 143 seconds.
[  179.241669]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.242419] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.243500] task:kworker/1:0H    state:I stack:29760 pid:21    ppid:2      flags:0x00004000
[  179.244662] Workqueue:  0x0 (events_highpri)
[  179.245310] Call Trace:
[  179.245674]  <TASK>
[  179.246025]  __schedule+0x893/0x2470
[  179.246577]  ? io_schedule_timeout+0x150/0x150
[  179.247285]  schedule+0xda/0x1b0
[  179.247777]  worker_thread+0x15f/0x1260
[  179.248391]  ? process_one_work+0x16a0/0x16a0
[  179.249058]  kthread+0x2ed/0x3a0
[  179.249550]  ? kthread_complete_and_exit+0x40/0x40
[  179.250273]  ret_from_fork+0x22/0x30
[  179.250829]  </TASK>
[  179.251530] INFO: task inet_frag_wq:23 blocked for more than 143 seconds.
[  179.252504]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.253257] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.254319] task:inet_frag_wq    state:I stack:30704 pid:23    ppid:2      flags:0x00004000
[  179.255491] Call Trace:
[  179.255856]  <TASK>
[  179.256207]  __schedule+0x893/0x2470
[  179.256753]  ? io_schedule_timeout+0x150/0x150
[  179.257411]  ? do_raw_spin_lock+0x121/0x260
[  179.258043]  ? rwlock_bug.part.0+0x90/0x90
[  179.258654]  schedule+0xda/0x1b0
[  179.259187]  rescuer_thread+0x851/0xdb0
[  179.259758]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.260480]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.261209]  ? lockdep_hardirqs_on+0x79/0x100
[  179.261847]  ? worker_thread+0x1260/0x1260
[  179.262483]  kthread+0x2ed/0x3a0
[  179.262992]  ? kthread_complete_and_exit+0x40/0x40
[  179.263690]  ret_from_fork+0x22/0x30
[  179.264262]  </TASK>
[  179.264594] INFO: task writeback:28 blocked for more than 143 seconds.
[  179.265498]       Not tainted 6.0.0-rc7-next-20220929 #1
[  179.266248] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  179.267322] task:writeback       state:I stack:30176 pid:28    ppid:2      flags:0x00004000
[  179.268481] Call Trace:
[  179.268839]  <TASK>
[  179.269189]  __schedule+0x893/0x2470
[  179.269735]  ? io_schedule_timeout+0x150/0x150
[  179.270405]  ? do_raw_spin_lock+0x121/0x260
[  179.271047]  ? rwlock_bug.part.0+0x90/0x90
[  179.271678]  schedule+0xda/0x1b0
[  179.272194]  rescuer_thread+0x851/0xdb0
[  179.272761]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.273489]  ? _raw_spin_unlock_irqrestore+0x28/0x60
[  179.274219]  ? lockdep_hardirqs_on+0x79/0x100
[  179.274893]  ? worker_thread+0x1260/0x1260
[  179.275510]  kthread+0x2ed/0x3a0
[  179.276026]  ? kthread_complete_and_exit+0x40/0x40
[  179.276712]  ret_from_fork+0x22/0x30
[  179.277288]  </TASK>
[  179.277683] 
[  179.277683] Showing all locks held in the system:
[  179.278511] 1 lock held by rcu_tasks_kthre/11:
[  179.279120]  #0: ffffffff85406890 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc10
[  179.280415] 1 lock held by khungtaskd/25:
[  179.280968]  #0: ffffffff85407360 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260
[  179.282180] 1 lock held by systemd-journal/112:
[  179.282777] 1 lock held by in:imklog/188:
[  179.283339]  #0: ffff888008d94368 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe7/0x100
[  179.284456] 3 locks held by syz-executor/4294:
[  179.285063] 
[  179.285296] =============================================
[  179.285296] 
[  183.758030] Bluetooth: hci3: command 0x0406 tx timeout
07:04:44 executing program 1:
write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24)
r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7)
r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0)
setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4)
r2 = socket$inet_icmp(0x2, 0x2, 0x1)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', <r3=>0x0})
r4 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCMIWAIT(r4, 0x545c, 0x0)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2)
sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0)
ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580))
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e})
socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
bind$packet(r6, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14)
connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14)
ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0))
socket$packet(0x11, 0x3, 0x300)

07:04:44 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:44 executing program 4:
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0)
r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0)
openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0)
r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0)
ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100))
r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0)
r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0)
ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7})
ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240))
r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=<r5=>0x0, &(0x7f0000000500)=<r6=>0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58)
clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=<r7=>0x0, &(0x7f0000000300)=<r8=>0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=<r9=>0x0)
clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=<r10=>0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58)
clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58)
r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00))

07:04:44 executing program 0:
r0 = socket$inet_icmp(0x2, 0x2, 0x1)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10)
socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0))
r3 = socket$nl_generic(0x10, 0x3, 0x10)
recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40)
r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0)
ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640))
setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4)
pipe2$9p(&(0x7f00000006c0), 0x80000)
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}})
ioctl$TIOCNXCL(r4, 0x540d)
ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76)
openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0)

07:04:44 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:44 executing program 3:
openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0)
ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0)
setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, <r0=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0)
socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10)
r3 = socket(0x26, 0x2, 0x3)
getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14)
bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14)
r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0))
syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0))

07:04:44 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640))
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)

07:04:44 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r1, 0x4b36)

07:04:44 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7)
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)

07:04:44 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
r2 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8})
ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:44 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0)
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:45 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0))
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r1, 0x4b36)

07:04:45 executing program 5:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000))
ioctl$KDSETMODE(r0, 0x4b3a, 0x1)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040))
r1 = syz_open_pts(r0, 0x202)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080))
syz_open_dev$ttys(0xc, 0x2, 0x1)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TCSETSW(r2, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"})

07:04:45 executing program 6:
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000))
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080))
r0 = syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100))
ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140))
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180))
pidfd_open(0xffffffffffffffff, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
ioctl$KDENABIO(r1, 0x4b36)

07:04:45 executing program 7:
ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000))
write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b)

07:04:45 executing program 2:
r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0)
syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00')
getitimer(0x0, &(0x7f0000000100))
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000)
semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9})
sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841)
add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0)
sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0)
semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151)


VM DIAGNOSIS:
07:04:37  Registers:
info registers vcpu 0
RAX=ffff8880362eb580 RBX=ffffc90000e91f70 RCX=ffffffff817bd131 RDX=1ffff11006c5d6b0
RSI=0000000000000008 RDI=ffff8880362eb580 RBP=dffffc0000000000 RSP=ffff88802e4a7a98
R8 =0000000000000000 R9 =ffff8880362eb587 R10=ffffed1006c5d6b0 R11=0000000000000001
R12=ffffc90000e91ff9 R13=ffff8880362eb580 R14=0000000000000000 R15=0000000000000086
RIP=ffffffff81785569 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000555556a55400 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055797135c648 CR3=000000001d4ce000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM02=0000000000000000 0000000000000000 0000000000000000 413c3fa000000000
YMM03=0000000000000000 0000000000000000 0000ff0000000000 0000000000000000
YMM04=0000000000000000 0000000000000000 732f6c61636f6c2f 7273752f3d485441
YMM05=0000000000000000 0000000000000000 622f6c61636f6c2f 7273752f3a6e6962
YMM06=0000000000000000 0000000000000000 73752f3a6e696273 2f7273752f3a6e69
YMM07=0000000000000000 0000000000000000 6e69622f3a6e6962 732f3a6e69622f72
YMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 1
RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9
RSI=ffffffff823ba33c RDI=ffffffff8765a9c0 RBP=ffffffff8765a980 RSP=ffff88800902f8a0
R8 =0000000000000001 R9 =ffff88800902f82b R10=ffffed1001205f05 R11=0000000000000001
R12=000000000000001b R13=ffffffff8765a980 R14=ffffffff8765a9d0 R15=ffffffff8765ac30
RIP=ffffffff823ba391 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00005579713b17f0 CR3=00000000177d2000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 00000000005d0546 00000000005d0bad
YMM02=0000000000000000 0000000000000000 00000000008a1f4c 00000000005d0546
YMM03=0000000000000000 0000000000000000 00000000004643c1 00000000008a1220
YMM04=0000000000000000 0000000000000000 000000c000ab99f8 000000c000ab99c0
YMM05=0000000000000000 0000000000000000 000000c000ab9a68 000000c000ab9a30
YMM06=0000000000000000 0000000000000000 000000c000ab9ad8 000000c000ab9aa0
YMM07=0000000000000000 0000000000000000 000000c000ab9b48 000000c000ab9b10
YMM08=0000000000000000 0000000000000000 000000c000ab9bb8 000000c000ab9b80
YMM09=0000000000000000 0000000000000000 000000c000ab9c28 000000c000ab9bf0
YMM10=0000000000000000 0000000000000000 000000c000ab9c98 000000c000ab9c60
YMM11=0000000000000000 0000000000000000 000000c000ab9d08 000000c000ab9cd0
YMM12=0000000000000000 0000000000000000 000000c000ab9d78 000000c000ab9d40
YMM13=0000000000000000 0000000000000000 000000c000ab9de8 000000c000ab9db0
YMM14=0000000000000000 0000000000000000 000000c000ab9e58 000000c000ab9e20
YMM15=0000000000000000 0000000000000000 000000c000ab9ec8 000000c000ab9e90