Warning: Permanently added '[localhost]:57717' (ECDSA) to the list of known hosts. 2025/11/09 22:26:21 fuzzer started 2025/11/09 22:26:21 dialing manager at localhost:41291 syzkaller login: [ 53.066730] cgroup: Unknown subsys name 'net' [ 53.120881] cgroup: Unknown subsys name 'cpuset' [ 53.133215] cgroup: Unknown subsys name 'rlimit' 2025/11/09 22:26:32 syscalls: 208 2025/11/09 22:26:32 code coverage: enabled 2025/11/09 22:26:32 comparison tracing: enabled 2025/11/09 22:26:32 extra coverage: enabled 2025/11/09 22:26:32 setuid sandbox: enabled 2025/11/09 22:26:32 namespace sandbox: enabled 2025/11/09 22:26:32 Android sandbox: enabled 2025/11/09 22:26:32 fault injection: enabled 2025/11/09 22:26:32 leak checking: enabled 2025/11/09 22:26:32 net packet injection: enabled 2025/11/09 22:26:32 net device setup: enabled 2025/11/09 22:26:32 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/11/09 22:26:32 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/11/09 22:26:32 USB emulation: enabled 2025/11/09 22:26:32 hci packet injection: enabled 2025/11/09 22:26:32 wifi device emulation: enabled 2025/11/09 22:26:32 802.15.4 emulation: enabled 2025/11/09 22:26:32 fetching corpus: 0, signal 0/0 (executing program) 2025/11/09 22:26:33 starting 8 fuzzer processes 22:26:33 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/90, &(0x7f00000000c0)=0x5a) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000100)=r0, 0x1) socketpair(0x1f, 0x6, 0x7, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(r0, 0x7dfa, 0x7f7b, 0x3, &(0x7f0000000180)={[0xfffffffffffffff7]}, 0x8) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xcc89e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x2040, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = io_uring_setup(0x4205, &(0x7f0000000240)={0x0, 0x695e, 0x20, 0x3, 0x272, 0x0, r2}) io_uring_register$IORING_REGISTER_PROBE(r3, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}]}, 0x4) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x802100}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008081}, 0x41) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000400)) getuid() r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000440)) r5 = syz_io_uring_setup(0x705a, &(0x7f0000000480)={0x0, 0xbca7, 0x0, 0x2, 0x194, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000500), &(0x7f0000000540)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f00000005c0)={0xffc, 0x0, &(0x7f0000000580)=[r5, 0xffffffffffffffff, r4]}, 0x3) r6 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000600)={0x1f, 0x0, @none}, &(0x7f0000000640)=0xe, 0x800) getsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, &(0x7f0000000680), &(0x7f00000006c0)=0xc) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x1, 0x0) ioctl$MON_IOCQ_RING_SIZE(r7, 0x9205) 22:26:33 executing program 0: sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1109000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x800, 0x70bd25, 0x6, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040014}, 0x4008084) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0x4c, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x95c0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x42bb5d39}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xad8a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x534e3ff6}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x198c2a9e}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7557}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x700a}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x4000080) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x74, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x74}, 0x1, 0x0, 0x0, 0x40850}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_KEY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r3, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x1) syz_usb_connect(0x1, 0x554, &(0x7f0000000680)={{0x12, 0x1, 0x110, 0x76, 0x78, 0xe5, 0x10, 0x1410, 0x2100, 0x55c5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x542, 0x4, 0x40, 0x7, 0x40, 0x6, [{{0x9, 0x4, 0x90, 0x51, 0x1, 0xac, 0x72, 0x6, 0x5, [@uac_as={[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x9, 0x1, 0x2, 0x0, '+&'}, @as_header={0x7, 0x24, 0x1, 0x2, 0x3, 0x1001}]}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0xfbff}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x4978, 0x6, 0x7f}, {0x6, 0x24, 0x1a, 0x9, 0x20}, [@call_mgmt={0x5, 0x24, 0x1, 0x0, 0x1}, @mdlm={0x15, 0x24, 0x12, 0x6}, @country_functional={0x8, 0x24, 0x7, 0x7, 0x7, [0x657a]}, @network_terminal={0x7, 0x24, 0xa, 0x8, 0x9, 0x2}, @mbim={0xc, 0x24, 0x1b, 0x40, 0x80, 0x7f, 0x6, 0x7, 0x8}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x1, 0x3, 0x10}]}], [{{0x9, 0x5, 0xf, 0x3, 0x3bf, 0xab, 0x18, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x74f}, @generic={0x91, 0x11, "bac0e161202948ec0352c055ea0fc0ea3f3dd36c32d882b1dca88a2fd510d429f205db8a6d417d4c405cdabf7ce89a8539316fa81d42c76d019f0d839d1043323a7074c834b6446e6012afc951b1f70f73d4623f0eb6f1f2090a5153646a5056ab279871dfec6a8f179b907da6833d08fba2736a5aeae57b909f2d237e38be43a58cc723b93960d44effd4cb3ae5f0"}]}}]}}, {{0x9, 0x4, 0xbd, 0x20, 0xf, 0x22, 0x34, 0x2e, 0xa6, [@uac_as={[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xe1, 0x1, 0x8}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x9, 0x1, 0x1, 0xfe, "c60d"}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x8, 0x1, 0x9, 0x1, "620d1a", "09d32f"}]}], [{{0x9, 0x5, 0x4, 0x0, 0x400, 0x20, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x84, 0x0, 0x5}]}}, {{0x9, 0x5, 0xa, 0x4, 0x3ff, 0xfd, 0x4, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x8, 0x7}, @generic={0x17, 0x21, "2ab6e6d8e843f94a45aee885adc97744e96ed47c94"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x419ad0caf56b7c4e, 0x7f, 0x38, 0x1}}, {{0x9, 0x5, 0x8, 0x1, 0xc38, 0x2, 0x6, 0xa9, [@generic={0xd2, 0x4, "734208d94063a780db4b9fb5cb7228bc2248f67a4e98058855850bb8feaee163707711f1dabd3467be67fbf87bc14056d98d6449dc9c9c44fe81c8385c2743e71a8b268cc7b27d531d121046067a4e3539b5e37029ccaca7f49214fb9c6fa632aa56e1eab71ae6783604bf6684374637572ad4ec768c0f70fecbee726305b374266c3098de06ade06edcc72f056b19526ee57a1f1d13516b111ab3a168887655874dd7fae1f9b206b704a15c4e3402882cfa5b946e7fe54b7daef76ca41ff1ac7d1e66c98ee767d84fb2b43dfc5e35f3"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x8, 0x0, 0x9, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1f, 0x7ff}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0x0, 0x5, 0x3, [@generic={0xd5, 0x4, "c397e9d9bc483f0fce566f12039a7abc64cd09db48c79f9b3eca858ed2cb2fb45be87b939b7ace968fa25516ce0a87b0beea6888685bf4f4ed4458540629e24cff6c61de69f1d287570315365522267ac147ff746f218d08f1f5a9ca9a6e23d351d1ecfee6d075544cfbe3dd3052bd96e1bdda80ab7ca357d3deb132463d25750d6b4ca6e26018f237915a76f7e5bc68ae5a9888da9cc386d8e2f43e726783e0249d6768b652e6275ca244633fc5f449ded9028cbe92dc4d0b76b1186453a6280fa3e8804bceb80e85b09c83c2b9f82a60eae6"}]}}, {{0x9, 0x5, 0x7, 0x2, 0x20, 0x7f, 0x6, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x1}, @generic={0x63, 0xd, "a2f14b1758dd5270887c930565df4061bb255577c1a25308f3ca0b0dc3b4d09f0900b7581a13395c7aee6a06de82a7d6f34ad5f219aa3d7c311225aab1516f438649e1aa8b349a4aae4dc54fe002c46214387df5bc1e1ff68387564dfd86d6e48e"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x400, 0x24, 0x7f, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x5f}, @generic={0x9e, 0x6, "55f6432951db8e23837f06624f25d11c8d234f4af354faa30cfc6a1ec71c2a7e06489198193e0798a6b3ef7f63a33ac65a557894ed6e6c08c158b6cb34c3be66e345182945d1b38d97bd37a1b027a1de9323af96f21e9f588dec7c4c954ed0c8ea58d8c29466aaf66eacbc5dd07eb0283b0a1ee3ad358d31e2407c99997c025562f5becb4ee6898dffe69d4eaac3d0eedf05001a154a55922d5ddf47"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x3ff, 0x0, 0x64, 0x3f}}, {{0x9, 0x5, 0x2, 0x3, 0x0, 0x7, 0xeb, 0x2}}, {{0x9, 0x5, 0x9, 0x2, 0x40, 0x3, 0x3f, 0x3}}, {{0x9, 0x5, 0x7, 0x0, 0x400, 0xff, 0x2, 0x20}}, {{0x9, 0x5, 0xf, 0x0, 0x200, 0x4, 0x3, 0x81, [@generic={0x40, 0x3d, "8add444af55a89f72e08af111dc70b308f993aaa09a72a414707e38091fb249ab4f3607c04efed952872fdb222b0b17ca598622d65faa177f1fafcc142df"}]}}, {{0x9, 0x5, 0x5, 0x1, 0x20, 0x4, 0x1, 0xce}}, {{0x9, 0x5, 0xb, 0x8, 0x20, 0x20, 0xff, 0x1f}}]}}, {{0x9, 0x4, 0x50, 0x7f, 0x1, 0x1b, 0x1c, 0xef, 0x0, [], [{{0x9, 0x5, 0x8, 0x0, 0x8, 0x3, 0x1, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x3f, 0xc3}, @generic={0x31, 0x24, "d4a1b99e1db7a46effdb38aa5b73e822ad3e3c7c8b13f36deaf242a80e7844f1f13795f7a809bb4221dd0440a9a407"}]}}]}}, {{0x9, 0x4, 0x2c, 0x0, 0x0, 0xe0, 0x8c, 0xfd, 0xb6}}]}}]}}, &(0x7f00000010c0)={0xa, &(0x7f0000000c00)={0xa, 0x6, 0x0, 0x3, 0x0, 0x0, 0x20, 0x4}, 0x119, &(0x7f0000000c40)={0x5, 0xf, 0x119, 0x4, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x20, "4977db15f473c1fc1b5a91fecb30e173"}, @generic={0xe9, 0x10, 0x3, "99b84b20e1958db5b44aae3b6e59de1341b636d952acb34add1a846fc0860d6c39561b68d35973de4a53b78905eff788cb5a189d5b172ee354bf512d4ceb26bc28f35faf814dc49c94f992b85a867964f1635ed33247227d6aa6bc2e6e261d01f42a31d5d6a584779ce560413667ed266f89e0afd6a287e546394b4403f4d47953ec0496df6d49c26095a63de45b0d9c4fef799c00ed2e8e5227b12bac05e43d63bdb6fb8054b061a634547f0a5374f9f9820afd0079eb40cdb3f57a28f3b68b1276cd9586084960d36bd9df86332cb8e2a5f728ffbb586c0824967896a495301964bde99aa2"}, @ss_container_id={0x14, 0x10, 0x4, 0x7f, "6dbc7260d0129f6902b95a3e681c8613"}]}, 0x7, [{0xd5, &(0x7f0000000d80)=@string={0xd5, 0x3, "7ec053f6e4db026be2dbff5304612788da4ffea29beb5dce01d7dfa8d604cf64fb59bf1dd1edeb070db0481565949b5314ad58abe75ed08bbf74adb492603bea7fa6387fbd40c6772404bccbf7654f82b412304ae646275007a60575955e85e474edeaf5a58c8fab330526c8b54e46e2c0792ef2683f821e0303c614308469155434099dd1431b73760eaf860d9678b5553252df0b857c821b1c22a6a93302411d23b690a59c4ceb9f4f7d254e817f40876352ec53ab0d1217b02679fddbb2969c419b1828662f331626693a80784bf26e4baf"}}, {0x4, &(0x7f0000000e80)=@lang_id={0x4, 0x3, 0xc1a}}, {0x2d, &(0x7f0000000ec0)=@string={0x2d, 0x3, "bf9815ac2b2a468cc5cff2f3f60cb488dc0d90086dca1fbba3801d5053734c37be5f47808b37e7175b0b72"}}, {0x4, &(0x7f0000000f00)=@lang_id={0x4, 0x3, 0x424}}, {0xd7, &(0x7f0000000f40)=@string={0xd7, 0x3, "f310ea485163138a8439be47a78269b9f84b8d33d97b905765c70becb9bad2cfd4fc377c80b570cba77b94e5cbf0c34d1fa85bebe5507278e574d3cbaedc4f697982f8603070259e61851a04cd634d9ea4c55a68063e80582249a863fef85caa7cb2f8c9024f6df922282c9136770234e160c84d781ca1222c5f68bed4a5615688f8004466d5be31d4d2330caee8eaac6684ea6de679f054eecbb16de8d95124b7c29e4116d02453cbd2f91b25e8a5885441d17c9bf860fd1c84c0f9d0e8859e0cfde0831f1abd49a7c93aab8715899426dd5b1813"}}, {0x4, &(0x7f0000001040)=@lang_id={0x4, 0x3, 0x44e}}, {0x4, &(0x7f0000001080)=@lang_id={0x4, 0x3, 0x422}}]}) sendmsg$IEEE802154_LIST_PHY(r2, &(0x7f0000001200)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x14, r3, 0x10, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x460d8}, 0x40) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001280), r2) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001300)={&(0x7f00000012c0)={0x20, r4, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x41}, 0x4800) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000001380)={'wpan3\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$IEEE802154_LIST_IFACE(r7, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r8, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x80) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001540), r2) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f0000001640)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x5c, r9, 0x31c, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x60}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000004}, 0x42081) 22:26:33 executing program 1: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x80010, 0xffffffffffffffff, 0x8000000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) syz_io_uring_setup(0x71e1, &(0x7f00000000c0)={0x0, 0x37d1, 0x20, 0x3, 0x31a, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r3, 0x50a, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_NETNS_FD={0x8, 0x1d, r0}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4006}, 0x20000800) syz_genetlink_get_family_id$gtp(&(0x7f0000000300), r1) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000340)) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000380)) setns(r4, 0x0) syz_genetlink_get_family_id$fou(&(0x7f00000003c0), r1) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000400)='\x00', 0x0, 0xffffffffffffffff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r5, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000700)={&(0x7f0000000480)={0x250, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x110, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xab}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4842ca35}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x55}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x41b4e1df}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ab1b9a5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x10001}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x28}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1ad38da7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x516f5f91}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x37b199be}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6dc4a610}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x79b47f9e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x149f48c2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3e20a503}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1a603d97}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xac1b2bc}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8c}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8}, @NLBL_CIPSOV4_A_TAGLST={0x3c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x3}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x3}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x88, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe493}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x75c96a16}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x51f8}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x74137221}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x786}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x158c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1f43897d}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2a403a5e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcf8e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1bbef1dc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x41810d5c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7b82}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf9e2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd8f}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9a70}]}]}, @NLBL_CIPSOV4_A_DOI={0x8}]}, 0x250}, 0x1, 0x0, 0x0, 0x200408d0}, 0x8809) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000880)={&(0x7f0000000780), 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x68, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x40000) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x20, 0x0, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0xc0) 22:26:33 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r6 = fsmount(r0, 0x0, 0x6) r7 = syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) r8 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, r7, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x24}}, 0x240000d0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r9, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x68, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x200540d1}, 0x10) [ 64.132970] audit: type=1400 audit(1762727193.926:7): avc: denied { execmem } for pid=275 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 22:26:33 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x6) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000600)='ns/user\x00') bind$bt_sco(r1, &(0x7f0000000640)={0x1f, @none}, 0x8) r3 = semget$private(0x0, 0x3, 0x259) semctl$GETZCNT(r3, 0x1, 0xf, &(0x7f0000000680)=""/212) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000780), &(0x7f00000007c0)=0xc) 22:26:33 executing program 6: syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x100) setns(0xffffffffffffffff, 0x4000000) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r0, 0x20, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x1a}, @val={0x8}, @val={0xc, 0x99, {0x200, 0x6e}}}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x34}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}]}, 0x48}}, 0x8001) r2 = ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x3000, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@fscache}], [{@audit}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000340)={{r3, r4+10000000}, {r5, r6+60000000}}, &(0x7f0000000380)) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000003c0)=""/236) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x34}}, 0x40801) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x34, r8, 0x800, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x101}]}, 0x34}, 0x1, 0x0, 0x0, 0x44884}, 0x8000) io_uring_setup(0x6e8b, &(0x7f0000000740)={0x0, 0x48e5, 0x20, 0x1, 0xfe}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) r10 = syz_open_procfs(0x0, &(0x7f00000007c0)='net/rpc\x00') io_uring_register$IORING_UNREGISTER_BUFFERS(r10, 0x1, 0x0, 0x0) 22:26:33 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_TID={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x20044801}, 0x20000000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x44000) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200)=@ccm_128={{0x304}, "f8cea6848869d065", "ca77eb81c9c90c677aa3c45a13ac6062", "34659732", "e62c0312d60d7017"}, 0x28) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000240)=@ccm_128={{0x7}, "3b881671b158c712", "136567a947514a4de33d780a9aac13c1", "7f4bbb1b", "d150044c57655d57"}, 0x28) ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000280)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000380), 0x4) r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x8000, 0x600d01) getsockopt$inet_tcp_int(r1, 0x6, 0x25, &(0x7f0000000400), &(0x7f0000000440)=0x4) socketpair(0x25, 0x6, 0x3b46edac, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000004c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000000500), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000540)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x4c, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x20008091) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x5c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8080}, 0x40000) sendmsg$IEEE802154_SET_MACPARAMS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x2c, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0xff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000800) getuid() ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000940)=0x8000) 22:26:34 executing program 7: bind$bt_sco(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @none}, 0x8) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x80, r0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x80}, 0x1, 0x0, 0x0, 0x880}, 0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048041}, 0x44) r2 = socket(0x18, 0x1, 0x5) connect$bt_sco(r2, &(0x7f0000000300)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) ioctl$MON_IOCQ_URB_LEN(0xffffffffffffffff, 0x9201) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r3, &(0x7f0000000340)={0x1f, 0x4, @none, 0x8}, 0xe) socket(0x6, 0x80000, 0x1f) r4 = socket(0x1, 0x5, 0x7fffffff) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x20, 0x70bd29, 0x25dfdbfb, {}, [@GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20004041) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r5, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r6, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x24040081) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, r6, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x200050c4) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x20, r6, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0xc000) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000800)='pci\x00', &(0x7f0000000840)='\x00', 0x0) ioctl$MON_IOCT_RING_SIZE(0xffffffffffffffff, 0x9204, 0x3d092) [ 65.327685] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 65.329611] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 65.331816] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 65.335187] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 65.337113] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 65.340425] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 65.343479] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 65.344480] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 65.347679] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 65.353137] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 65.402064] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 65.408147] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 65.410466] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 65.416237] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 65.422170] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 65.469752] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 65.471466] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 65.473141] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 65.475271] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 65.476352] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 65.479380] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 65.479808] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 65.481770] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 65.488075] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 65.490002] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 65.493082] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 65.493566] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 65.497568] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 65.498780] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 65.502443] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 65.506265] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 65.507985] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 65.509199] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 65.518063] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 65.523993] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 65.535804] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 65.538702] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 65.546202] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 65.549885] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 65.561103] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 67.420007] Bluetooth: hci0: command tx timeout [ 67.420020] Bluetooth: hci1: command tx timeout [ 67.483045] Bluetooth: hci2: command tx timeout [ 67.611145] Bluetooth: hci6: command tx timeout [ 67.611246] Bluetooth: hci5: command tx timeout [ 67.613204] Bluetooth: hci4: command tx timeout [ 67.674936] Bluetooth: hci3: command tx timeout [ 67.674963] Bluetooth: hci7: command tx timeout [ 69.467004] Bluetooth: hci0: command tx timeout [ 69.467034] Bluetooth: hci1: command tx timeout [ 69.531242] Bluetooth: hci2: command tx timeout [ 69.658956] Bluetooth: hci5: command tx timeout [ 69.659725] Bluetooth: hci6: command tx timeout [ 69.659875] Bluetooth: hci4: command tx timeout [ 69.723529] Bluetooth: hci7: command tx timeout [ 69.724046] Bluetooth: hci3: command tx timeout [ 71.514979] Bluetooth: hci0: command tx timeout [ 71.515446] Bluetooth: hci1: command tx timeout [ 71.578957] Bluetooth: hci2: command tx timeout [ 71.706900] Bluetooth: hci5: command tx timeout [ 71.707294] Bluetooth: hci6: command tx timeout [ 71.707672] Bluetooth: hci4: command tx timeout [ 71.770896] Bluetooth: hci7: command tx timeout [ 71.771283] Bluetooth: hci3: command tx timeout [ 73.563057] Bluetooth: hci1: command tx timeout [ 73.563501] Bluetooth: hci0: command tx timeout [ 73.627984] Bluetooth: hci2: command tx timeout [ 73.755954] Bluetooth: hci4: command tx timeout [ 73.756354] Bluetooth: hci6: command tx timeout [ 73.756743] Bluetooth: hci5: command tx timeout [ 73.819976] Bluetooth: hci7: command tx timeout [ 73.820369] Bluetooth: hci3: command tx timeout [ 101.543266] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.543947] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.736404] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.737021] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 22:27:12 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r6 = fsmount(r0, 0x0, 0x6) r7 = syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) r8 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, r7, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x24}}, 0x240000d0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r9, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x68, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x200540d1}, 0x10) 22:27:12 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r6 = fsmount(r0, 0x0, 0x6) r7 = syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) r8 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, r7, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x24}}, 0x240000d0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r9, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x68, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x200540d1}, 0x10) 22:27:13 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r6 = fsmount(r0, 0x0, 0x6) r7 = syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) r8 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, r7, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x24}}, 0x240000d0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r9, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x68, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x200540d1}, 0x10) 22:27:13 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r6 = fsmount(r0, 0x0, 0x6) r7 = syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) r8 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, r7, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x24}}, 0x240000d0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)) [ 104.074165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.074804] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.186246] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.187567] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 22:27:14 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r6 = fsmount(r0, 0x0, 0x6) r7 = syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) r8 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, r7, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x24}}, 0x240000d0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)) 22:27:14 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r6 = fsmount(r0, 0x0, 0x6) r7 = syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) r8 = ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, r7, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x24}}, 0x240000d0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)) [ 105.158284] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.159281] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.289938] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.290563] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.863131] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.863762] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.930152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.930758] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.069852] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.070445] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.140868] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.141042] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.141480] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.147133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.478772] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.479873] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.531000] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.531630] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.751241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.752291] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.970980] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.971628] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.004600] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.005236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.265553] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.266200] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.286688] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.287279] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 22:27:27 executing program 7: bind$bt_sco(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @none}, 0x8) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x80, r0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x80}, 0x1, 0x0, 0x0, 0x880}, 0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048041}, 0x44) r2 = socket(0x18, 0x1, 0x5) connect$bt_sco(r2, &(0x7f0000000300)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) ioctl$MON_IOCQ_URB_LEN(0xffffffffffffffff, 0x9201) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r3, &(0x7f0000000340)={0x1f, 0x4, @none, 0x8}, 0xe) socket(0x6, 0x80000, 0x1f) r4 = socket(0x1, 0x5, 0x7fffffff) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x20, 0x70bd29, 0x25dfdbfb, {}, [@GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20004041) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r5, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r6, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x24040081) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, r6, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x200050c4) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x20, r6, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0xc000) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000800)='pci\x00', &(0x7f0000000840)='\x00', 0x0) ioctl$MON_IOCT_RING_SIZE(0xffffffffffffffff, 0x9204, 0x3d092) 22:27:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/90, &(0x7f00000000c0)=0x5a) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000100)=r0, 0x1) socketpair(0x1f, 0x6, 0x7, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(r0, 0x7dfa, 0x7f7b, 0x3, &(0x7f0000000180)={[0xfffffffffffffff7]}, 0x8) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xcc89e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x2040, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = io_uring_setup(0x4205, &(0x7f0000000240)={0x0, 0x695e, 0x20, 0x3, 0x272, 0x0, r2}) io_uring_register$IORING_REGISTER_PROBE(r3, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}]}, 0x4) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x802100}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008081}, 0x41) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000400)) getuid() r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000440)) r5 = syz_io_uring_setup(0x705a, &(0x7f0000000480)={0x0, 0xbca7, 0x0, 0x2, 0x194, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000500), &(0x7f0000000540)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f00000005c0)={0xffc, 0x0, &(0x7f0000000580)=[r5, 0xffffffffffffffff, r4]}, 0x3) r6 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000600)={0x1f, 0x0, @none}, &(0x7f0000000640)=0xe, 0x800) getsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, &(0x7f0000000680), &(0x7f00000006c0)=0xc) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x1, 0x0) ioctl$MON_IOCQ_RING_SIZE(r7, 0x9205) 22:27:27 executing program 6: syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x100) setns(0xffffffffffffffff, 0x4000000) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r0, 0x20, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x1a}, @val={0x8}, @val={0xc, 0x99, {0x200, 0x6e}}}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x34}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}]}, 0x48}}, 0x8001) r2 = ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x3000, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@fscache}], [{@audit}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000340)={{r3, r4+10000000}, {r5, r6+60000000}}, &(0x7f0000000380)) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000003c0)=""/236) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x34}}, 0x40801) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x34, r8, 0x800, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x101}]}, 0x34}, 0x1, 0x0, 0x0, 0x44884}, 0x8000) io_uring_setup(0x6e8b, &(0x7f0000000740)={0x0, 0x48e5, 0x20, 0x1, 0xfe}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) r10 = syz_open_procfs(0x0, &(0x7f00000007c0)='net/rpc\x00') io_uring_register$IORING_UNREGISTER_BUFFERS(r10, 0x1, 0x0, 0x0) 22:27:27 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) fsmount(r0, 0x0, 0x6) syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x68, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x200540d1}, 0x10) 22:27:27 executing program 1: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x80010, 0xffffffffffffffff, 0x8000000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) syz_io_uring_setup(0x71e1, &(0x7f00000000c0)={0x0, 0x37d1, 0x20, 0x3, 0x31a, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r3, 0x50a, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_NETNS_FD={0x8, 0x1d, r0}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4006}, 0x20000800) syz_genetlink_get_family_id$gtp(&(0x7f0000000300), r1) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000340)) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000380)) setns(r4, 0x0) syz_genetlink_get_family_id$fou(&(0x7f00000003c0), r1) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000400)='\x00', 0x0, 0xffffffffffffffff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r5, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000700)={&(0x7f0000000480)={0x250, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x110, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xab}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4842ca35}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x55}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x41b4e1df}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ab1b9a5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x10001}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x28}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1ad38da7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x516f5f91}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x37b199be}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6dc4a610}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x79b47f9e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x149f48c2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3e20a503}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1a603d97}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xac1b2bc}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8c}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8}, @NLBL_CIPSOV4_A_TAGLST={0x3c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x3}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x3}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x88, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe493}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x75c96a16}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x51f8}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x74137221}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x786}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x158c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1f43897d}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2a403a5e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcf8e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1bbef1dc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x41810d5c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7b82}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf9e2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd8f}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9a70}]}]}, @NLBL_CIPSOV4_A_DOI={0x8}]}, 0x250}, 0x1, 0x0, 0x0, 0x200408d0}, 0x8809) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000880)={&(0x7f0000000780), 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x68, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x40000) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x20, 0x0, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0xc0) 22:27:27 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x6) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000600)='ns/user\x00') bind$bt_sco(r1, &(0x7f0000000640)={0x1f, @none}, 0x8) r3 = semget$private(0x0, 0x3, 0x259) semctl$GETZCNT(r3, 0x1, 0xf, &(0x7f0000000680)=""/212) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000780), &(0x7f00000007c0)=0xc) 22:27:27 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_TID={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x20044801}, 0x20000000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x44000) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200)=@ccm_128={{0x304}, "f8cea6848869d065", "ca77eb81c9c90c677aa3c45a13ac6062", "34659732", "e62c0312d60d7017"}, 0x28) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000240)=@ccm_128={{0x7}, "3b881671b158c712", "136567a947514a4de33d780a9aac13c1", "7f4bbb1b", "d150044c57655d57"}, 0x28) ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000280)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000380), 0x4) r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x8000, 0x600d01) getsockopt$inet_tcp_int(r1, 0x6, 0x25, &(0x7f0000000400), &(0x7f0000000440)=0x4) socketpair(0x25, 0x6, 0x3b46edac, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000004c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000000500), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000540)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x4c, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x20008091) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x5c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8080}, 0x40000) sendmsg$IEEE802154_SET_MACPARAMS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x2c, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0xff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000800) getuid() ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000940)=0x8000) 22:27:27 executing program 0: sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1109000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x800, 0x70bd25, 0x6, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040014}, 0x4008084) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0x4c, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x95c0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x42bb5d39}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xad8a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x534e3ff6}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x198c2a9e}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7557}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x700a}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x4000080) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x74, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x74}, 0x1, 0x0, 0x0, 0x40850}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_KEY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r3, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x1) syz_usb_connect(0x1, 0x554, &(0x7f0000000680)={{0x12, 0x1, 0x110, 0x76, 0x78, 0xe5, 0x10, 0x1410, 0x2100, 0x55c5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x542, 0x4, 0x40, 0x7, 0x40, 0x6, [{{0x9, 0x4, 0x90, 0x51, 0x1, 0xac, 0x72, 0x6, 0x5, [@uac_as={[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x9, 0x1, 0x2, 0x0, '+&'}, @as_header={0x7, 0x24, 0x1, 0x2, 0x3, 0x1001}]}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0xfbff}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x4978, 0x6, 0x7f}, {0x6, 0x24, 0x1a, 0x9, 0x20}, [@call_mgmt={0x5, 0x24, 0x1, 0x0, 0x1}, @mdlm={0x15, 0x24, 0x12, 0x6}, @country_functional={0x8, 0x24, 0x7, 0x7, 0x7, [0x657a]}, @network_terminal={0x7, 0x24, 0xa, 0x8, 0x9, 0x2}, @mbim={0xc, 0x24, 0x1b, 0x40, 0x80, 0x7f, 0x6, 0x7, 0x8}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x1, 0x3, 0x10}]}], [{{0x9, 0x5, 0xf, 0x3, 0x3bf, 0xab, 0x18, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x74f}, @generic={0x91, 0x11, "bac0e161202948ec0352c055ea0fc0ea3f3dd36c32d882b1dca88a2fd510d429f205db8a6d417d4c405cdabf7ce89a8539316fa81d42c76d019f0d839d1043323a7074c834b6446e6012afc951b1f70f73d4623f0eb6f1f2090a5153646a5056ab279871dfec6a8f179b907da6833d08fba2736a5aeae57b909f2d237e38be43a58cc723b93960d44effd4cb3ae5f0"}]}}]}}, {{0x9, 0x4, 0xbd, 0x20, 0xf, 0x22, 0x34, 0x2e, 0xa6, [@uac_as={[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xe1, 0x1, 0x8}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x9, 0x1, 0x1, 0xfe, "c60d"}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x8, 0x1, 0x9, 0x1, "620d1a", "09d32f"}]}], [{{0x9, 0x5, 0x4, 0x0, 0x400, 0x20, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x84, 0x0, 0x5}]}}, {{0x9, 0x5, 0xa, 0x4, 0x3ff, 0xfd, 0x4, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x8, 0x7}, @generic={0x17, 0x21, "2ab6e6d8e843f94a45aee885adc97744e96ed47c94"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x419ad0caf56b7c4e, 0x7f, 0x38, 0x1}}, {{0x9, 0x5, 0x8, 0x1, 0xc38, 0x2, 0x6, 0xa9, [@generic={0xd2, 0x4, "734208d94063a780db4b9fb5cb7228bc2248f67a4e98058855850bb8feaee163707711f1dabd3467be67fbf87bc14056d98d6449dc9c9c44fe81c8385c2743e71a8b268cc7b27d531d121046067a4e3539b5e37029ccaca7f49214fb9c6fa632aa56e1eab71ae6783604bf6684374637572ad4ec768c0f70fecbee726305b374266c3098de06ade06edcc72f056b19526ee57a1f1d13516b111ab3a168887655874dd7fae1f9b206b704a15c4e3402882cfa5b946e7fe54b7daef76ca41ff1ac7d1e66c98ee767d84fb2b43dfc5e35f3"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x8, 0x0, 0x9, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1f, 0x7ff}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0x0, 0x5, 0x3, [@generic={0xd5, 0x4, "c397e9d9bc483f0fce566f12039a7abc64cd09db48c79f9b3eca858ed2cb2fb45be87b939b7ace968fa25516ce0a87b0beea6888685bf4f4ed4458540629e24cff6c61de69f1d287570315365522267ac147ff746f218d08f1f5a9ca9a6e23d351d1ecfee6d075544cfbe3dd3052bd96e1bdda80ab7ca357d3deb132463d25750d6b4ca6e26018f237915a76f7e5bc68ae5a9888da9cc386d8e2f43e726783e0249d6768b652e6275ca244633fc5f449ded9028cbe92dc4d0b76b1186453a6280fa3e8804bceb80e85b09c83c2b9f82a60eae6"}]}}, {{0x9, 0x5, 0x7, 0x2, 0x20, 0x7f, 0x6, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x1}, @generic={0x63, 0xd, "a2f14b1758dd5270887c930565df4061bb255577c1a25308f3ca0b0dc3b4d09f0900b7581a13395c7aee6a06de82a7d6f34ad5f219aa3d7c311225aab1516f438649e1aa8b349a4aae4dc54fe002c46214387df5bc1e1ff68387564dfd86d6e48e"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x400, 0x24, 0x7f, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x5f}, @generic={0x9e, 0x6, "55f6432951db8e23837f06624f25d11c8d234f4af354faa30cfc6a1ec71c2a7e06489198193e0798a6b3ef7f63a33ac65a557894ed6e6c08c158b6cb34c3be66e345182945d1b38d97bd37a1b027a1de9323af96f21e9f588dec7c4c954ed0c8ea58d8c29466aaf66eacbc5dd07eb0283b0a1ee3ad358d31e2407c99997c025562f5becb4ee6898dffe69d4eaac3d0eedf05001a154a55922d5ddf47"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x3ff, 0x0, 0x64, 0x3f}}, {{0x9, 0x5, 0x2, 0x3, 0x0, 0x7, 0xeb, 0x2}}, {{0x9, 0x5, 0x9, 0x2, 0x40, 0x3, 0x3f, 0x3}}, {{0x9, 0x5, 0x7, 0x0, 0x400, 0xff, 0x2, 0x20}}, {{0x9, 0x5, 0xf, 0x0, 0x200, 0x4, 0x3, 0x81, [@generic={0x40, 0x3d, "8add444af55a89f72e08af111dc70b308f993aaa09a72a414707e38091fb249ab4f3607c04efed952872fdb222b0b17ca598622d65faa177f1fafcc142df"}]}}, {{0x9, 0x5, 0x5, 0x1, 0x20, 0x4, 0x1, 0xce}}, {{0x9, 0x5, 0xb, 0x8, 0x20, 0x20, 0xff, 0x1f}}]}}, {{0x9, 0x4, 0x50, 0x7f, 0x1, 0x1b, 0x1c, 0xef, 0x0, [], [{{0x9, 0x5, 0x8, 0x0, 0x8, 0x3, 0x1, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x3f, 0xc3}, @generic={0x31, 0x24, "d4a1b99e1db7a46effdb38aa5b73e822ad3e3c7c8b13f36deaf242a80e7844f1f13795f7a809bb4221dd0440a9a407"}]}}]}}, {{0x9, 0x4, 0x2c, 0x0, 0x0, 0xe0, 0x8c, 0xfd, 0xb6}}]}}]}}, &(0x7f00000010c0)={0xa, &(0x7f0000000c00)={0xa, 0x6, 0x0, 0x3, 0x0, 0x0, 0x20, 0x4}, 0x119, &(0x7f0000000c40)={0x5, 0xf, 0x119, 0x4, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x20, "4977db15f473c1fc1b5a91fecb30e173"}, @generic={0xe9, 0x10, 0x3, "99b84b20e1958db5b44aae3b6e59de1341b636d952acb34add1a846fc0860d6c39561b68d35973de4a53b78905eff788cb5a189d5b172ee354bf512d4ceb26bc28f35faf814dc49c94f992b85a867964f1635ed33247227d6aa6bc2e6e261d01f42a31d5d6a584779ce560413667ed266f89e0afd6a287e546394b4403f4d47953ec0496df6d49c26095a63de45b0d9c4fef799c00ed2e8e5227b12bac05e43d63bdb6fb8054b061a634547f0a5374f9f9820afd0079eb40cdb3f57a28f3b68b1276cd9586084960d36bd9df86332cb8e2a5f728ffbb586c0824967896a495301964bde99aa2"}, @ss_container_id={0x14, 0x10, 0x4, 0x7f, "6dbc7260d0129f6902b95a3e681c8613"}]}, 0x7, [{0xd5, &(0x7f0000000d80)=@string={0xd5, 0x3, "7ec053f6e4db026be2dbff5304612788da4ffea29beb5dce01d7dfa8d604cf64fb59bf1dd1edeb070db0481565949b5314ad58abe75ed08bbf74adb492603bea7fa6387fbd40c6772404bccbf7654f82b412304ae646275007a60575955e85e474edeaf5a58c8fab330526c8b54e46e2c0792ef2683f821e0303c614308469155434099dd1431b73760eaf860d9678b5553252df0b857c821b1c22a6a93302411d23b690a59c4ceb9f4f7d254e817f40876352ec53ab0d1217b02679fddbb2969c419b1828662f331626693a80784bf26e4baf"}}, {0x4, &(0x7f0000000e80)=@lang_id={0x4, 0x3, 0xc1a}}, {0x2d, &(0x7f0000000ec0)=@string={0x2d, 0x3, "bf9815ac2b2a468cc5cff2f3f60cb488dc0d90086dca1fbba3801d5053734c37be5f47808b37e7175b0b72"}}, {0x4, &(0x7f0000000f00)=@lang_id={0x4, 0x3, 0x424}}, {0xd7, &(0x7f0000000f40)=@string={0xd7, 0x3, "f310ea485163138a8439be47a78269b9f84b8d33d97b905765c70becb9bad2cfd4fc377c80b570cba77b94e5cbf0c34d1fa85bebe5507278e574d3cbaedc4f697982f8603070259e61851a04cd634d9ea4c55a68063e80582249a863fef85caa7cb2f8c9024f6df922282c9136770234e160c84d781ca1222c5f68bed4a5615688f8004466d5be31d4d2330caee8eaac6684ea6de679f054eecbb16de8d95124b7c29e4116d02453cbd2f91b25e8a5885441d17c9bf860fd1c84c0f9d0e8859e0cfde0831f1abd49a7c93aab8715899426dd5b1813"}}, {0x4, &(0x7f0000001040)=@lang_id={0x4, 0x3, 0x44e}}, {0x4, &(0x7f0000001080)=@lang_id={0x4, 0x3, 0x422}}]}) sendmsg$IEEE802154_LIST_PHY(r2, &(0x7f0000001200)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x14, r3, 0x10, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x460d8}, 0x40) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001280), r2) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001300)={&(0x7f00000012c0)={0x20, r4, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x41}, 0x4800) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000001380)={'wpan3\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$IEEE802154_LIST_IFACE(r7, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r8, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x80) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001540), r2) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f0000001640)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x5c, r9, 0x31c, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x60}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000004}, 0x42081) [ 117.581022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.583170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 22:27:27 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x6) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000600)='ns/user\x00') bind$bt_sco(r1, &(0x7f0000000640)={0x1f, @none}, 0x8) r3 = semget$private(0x0, 0x3, 0x259) semctl$GETZCNT(r3, 0x1, 0xf, &(0x7f0000000680)=""/212) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000780), &(0x7f00000007c0)=0xc) 22:27:27 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x6) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000600)='ns/user\x00') bind$bt_sco(r1, &(0x7f0000000640)={0x1f, @none}, 0x8) r3 = semget$private(0x0, 0x3, 0x259) semctl$GETZCNT(r3, 0x1, 0xf, &(0x7f0000000680)=""/212) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000780), &(0x7f00000007c0)=0xc) 22:27:27 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/90, &(0x7f00000000c0)=0x5a) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000100)=r0, 0x1) socketpair(0x1f, 0x6, 0x7, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(r0, 0x7dfa, 0x7f7b, 0x3, &(0x7f0000000180)={[0xfffffffffffffff7]}, 0x8) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xcc89e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x2040, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = io_uring_setup(0x4205, &(0x7f0000000240)={0x0, 0x695e, 0x20, 0x3, 0x272, 0x0, r2}) io_uring_register$IORING_REGISTER_PROBE(r3, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}]}, 0x4) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x802100}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008081}, 0x41) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000400)) getuid() r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000440)) r5 = syz_io_uring_setup(0x705a, &(0x7f0000000480)={0x0, 0xbca7, 0x0, 0x2, 0x194, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000500), &(0x7f0000000540)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f00000005c0)={0xffc, 0x0, &(0x7f0000000580)=[r5, 0xffffffffffffffff, r4]}, 0x3) r6 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000600)={0x1f, 0x0, @none}, &(0x7f0000000640)=0xe, 0x800) getsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, &(0x7f0000000680), &(0x7f00000006c0)=0xc) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x1, 0x0) ioctl$MON_IOCQ_RING_SIZE(r7, 0x9205) 22:27:35 executing program 0: sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1109000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x800, 0x70bd25, 0x6, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040014}, 0x4008084) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0x4c, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x95c0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x42bb5d39}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xad8a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x534e3ff6}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x198c2a9e}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7557}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x700a}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x4000080) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x74, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x74}, 0x1, 0x0, 0x0, 0x40850}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_KEY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r3, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x1) syz_usb_connect(0x1, 0x554, &(0x7f0000000680)={{0x12, 0x1, 0x110, 0x76, 0x78, 0xe5, 0x10, 0x1410, 0x2100, 0x55c5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x542, 0x4, 0x40, 0x7, 0x40, 0x6, [{{0x9, 0x4, 0x90, 0x51, 0x1, 0xac, 0x72, 0x6, 0x5, [@uac_as={[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x9, 0x1, 0x2, 0x0, '+&'}, @as_header={0x7, 0x24, 0x1, 0x2, 0x3, 0x1001}]}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0xfbff}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x4978, 0x6, 0x7f}, {0x6, 0x24, 0x1a, 0x9, 0x20}, [@call_mgmt={0x5, 0x24, 0x1, 0x0, 0x1}, @mdlm={0x15, 0x24, 0x12, 0x6}, @country_functional={0x8, 0x24, 0x7, 0x7, 0x7, [0x657a]}, @network_terminal={0x7, 0x24, 0xa, 0x8, 0x9, 0x2}, @mbim={0xc, 0x24, 0x1b, 0x40, 0x80, 0x7f, 0x6, 0x7, 0x8}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x1, 0x3, 0x10}]}], [{{0x9, 0x5, 0xf, 0x3, 0x3bf, 0xab, 0x18, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x74f}, @generic={0x91, 0x11, "bac0e161202948ec0352c055ea0fc0ea3f3dd36c32d882b1dca88a2fd510d429f205db8a6d417d4c405cdabf7ce89a8539316fa81d42c76d019f0d839d1043323a7074c834b6446e6012afc951b1f70f73d4623f0eb6f1f2090a5153646a5056ab279871dfec6a8f179b907da6833d08fba2736a5aeae57b909f2d237e38be43a58cc723b93960d44effd4cb3ae5f0"}]}}]}}, {{0x9, 0x4, 0xbd, 0x20, 0xf, 0x22, 0x34, 0x2e, 0xa6, [@uac_as={[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xe1, 0x1, 0x8}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x9, 0x1, 0x1, 0xfe, "c60d"}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x8, 0x1, 0x9, 0x1, "620d1a", "09d32f"}]}], [{{0x9, 0x5, 0x4, 0x0, 0x400, 0x20, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x84, 0x0, 0x5}]}}, {{0x9, 0x5, 0xa, 0x4, 0x3ff, 0xfd, 0x4, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x8, 0x7}, @generic={0x17, 0x21, "2ab6e6d8e843f94a45aee885adc97744e96ed47c94"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x419ad0caf56b7c4e, 0x7f, 0x38, 0x1}}, {{0x9, 0x5, 0x8, 0x1, 0xc38, 0x2, 0x6, 0xa9, [@generic={0xd2, 0x4, "734208d94063a780db4b9fb5cb7228bc2248f67a4e98058855850bb8feaee163707711f1dabd3467be67fbf87bc14056d98d6449dc9c9c44fe81c8385c2743e71a8b268cc7b27d531d121046067a4e3539b5e37029ccaca7f49214fb9c6fa632aa56e1eab71ae6783604bf6684374637572ad4ec768c0f70fecbee726305b374266c3098de06ade06edcc72f056b19526ee57a1f1d13516b111ab3a168887655874dd7fae1f9b206b704a15c4e3402882cfa5b946e7fe54b7daef76ca41ff1ac7d1e66c98ee767d84fb2b43dfc5e35f3"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x8, 0x0, 0x9, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1f, 0x7ff}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0x0, 0x5, 0x3, [@generic={0xd5, 0x4, "c397e9d9bc483f0fce566f12039a7abc64cd09db48c79f9b3eca858ed2cb2fb45be87b939b7ace968fa25516ce0a87b0beea6888685bf4f4ed4458540629e24cff6c61de69f1d287570315365522267ac147ff746f218d08f1f5a9ca9a6e23d351d1ecfee6d075544cfbe3dd3052bd96e1bdda80ab7ca357d3deb132463d25750d6b4ca6e26018f237915a76f7e5bc68ae5a9888da9cc386d8e2f43e726783e0249d6768b652e6275ca244633fc5f449ded9028cbe92dc4d0b76b1186453a6280fa3e8804bceb80e85b09c83c2b9f82a60eae6"}]}}, {{0x9, 0x5, 0x7, 0x2, 0x20, 0x7f, 0x6, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x1}, @generic={0x63, 0xd, "a2f14b1758dd5270887c930565df4061bb255577c1a25308f3ca0b0dc3b4d09f0900b7581a13395c7aee6a06de82a7d6f34ad5f219aa3d7c311225aab1516f438649e1aa8b349a4aae4dc54fe002c46214387df5bc1e1ff68387564dfd86d6e48e"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x400, 0x24, 0x7f, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x5f}, @generic={0x9e, 0x6, "55f6432951db8e23837f06624f25d11c8d234f4af354faa30cfc6a1ec71c2a7e06489198193e0798a6b3ef7f63a33ac65a557894ed6e6c08c158b6cb34c3be66e345182945d1b38d97bd37a1b027a1de9323af96f21e9f588dec7c4c954ed0c8ea58d8c29466aaf66eacbc5dd07eb0283b0a1ee3ad358d31e2407c99997c025562f5becb4ee6898dffe69d4eaac3d0eedf05001a154a55922d5ddf47"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x3ff, 0x0, 0x64, 0x3f}}, {{0x9, 0x5, 0x2, 0x3, 0x0, 0x7, 0xeb, 0x2}}, {{0x9, 0x5, 0x9, 0x2, 0x40, 0x3, 0x3f, 0x3}}, {{0x9, 0x5, 0x7, 0x0, 0x400, 0xff, 0x2, 0x20}}, {{0x9, 0x5, 0xf, 0x0, 0x200, 0x4, 0x3, 0x81, [@generic={0x40, 0x3d, "8add444af55a89f72e08af111dc70b308f993aaa09a72a414707e38091fb249ab4f3607c04efed952872fdb222b0b17ca598622d65faa177f1fafcc142df"}]}}, {{0x9, 0x5, 0x5, 0x1, 0x20, 0x4, 0x1, 0xce}}, {{0x9, 0x5, 0xb, 0x8, 0x20, 0x20, 0xff, 0x1f}}]}}, {{0x9, 0x4, 0x50, 0x7f, 0x1, 0x1b, 0x1c, 0xef, 0x0, [], [{{0x9, 0x5, 0x8, 0x0, 0x8, 0x3, 0x1, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x3f, 0xc3}, @generic={0x31, 0x24, "d4a1b99e1db7a46effdb38aa5b73e822ad3e3c7c8b13f36deaf242a80e7844f1f13795f7a809bb4221dd0440a9a407"}]}}]}}, {{0x9, 0x4, 0x2c, 0x0, 0x0, 0xe0, 0x8c, 0xfd, 0xb6}}]}}]}}, &(0x7f00000010c0)={0xa, &(0x7f0000000c00)={0xa, 0x6, 0x0, 0x3, 0x0, 0x0, 0x20, 0x4}, 0x119, &(0x7f0000000c40)={0x5, 0xf, 0x119, 0x4, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x20, "4977db15f473c1fc1b5a91fecb30e173"}, @generic={0xe9, 0x10, 0x3, "99b84b20e1958db5b44aae3b6e59de1341b636d952acb34add1a846fc0860d6c39561b68d35973de4a53b78905eff788cb5a189d5b172ee354bf512d4ceb26bc28f35faf814dc49c94f992b85a867964f1635ed33247227d6aa6bc2e6e261d01f42a31d5d6a584779ce560413667ed266f89e0afd6a287e546394b4403f4d47953ec0496df6d49c26095a63de45b0d9c4fef799c00ed2e8e5227b12bac05e43d63bdb6fb8054b061a634547f0a5374f9f9820afd0079eb40cdb3f57a28f3b68b1276cd9586084960d36bd9df86332cb8e2a5f728ffbb586c0824967896a495301964bde99aa2"}, @ss_container_id={0x14, 0x10, 0x4, 0x7f, "6dbc7260d0129f6902b95a3e681c8613"}]}, 0x7, [{0xd5, &(0x7f0000000d80)=@string={0xd5, 0x3, "7ec053f6e4db026be2dbff5304612788da4ffea29beb5dce01d7dfa8d604cf64fb59bf1dd1edeb070db0481565949b5314ad58abe75ed08bbf74adb492603bea7fa6387fbd40c6772404bccbf7654f82b412304ae646275007a60575955e85e474edeaf5a58c8fab330526c8b54e46e2c0792ef2683f821e0303c614308469155434099dd1431b73760eaf860d9678b5553252df0b857c821b1c22a6a93302411d23b690a59c4ceb9f4f7d254e817f40876352ec53ab0d1217b02679fddbb2969c419b1828662f331626693a80784bf26e4baf"}}, {0x4, &(0x7f0000000e80)=@lang_id={0x4, 0x3, 0xc1a}}, {0x2d, &(0x7f0000000ec0)=@string={0x2d, 0x3, "bf9815ac2b2a468cc5cff2f3f60cb488dc0d90086dca1fbba3801d5053734c37be5f47808b37e7175b0b72"}}, {0x4, &(0x7f0000000f00)=@lang_id={0x4, 0x3, 0x424}}, {0xd7, &(0x7f0000000f40)=@string={0xd7, 0x3, "f310ea485163138a8439be47a78269b9f84b8d33d97b905765c70becb9bad2cfd4fc377c80b570cba77b94e5cbf0c34d1fa85bebe5507278e574d3cbaedc4f697982f8603070259e61851a04cd634d9ea4c55a68063e80582249a863fef85caa7cb2f8c9024f6df922282c9136770234e160c84d781ca1222c5f68bed4a5615688f8004466d5be31d4d2330caee8eaac6684ea6de679f054eecbb16de8d95124b7c29e4116d02453cbd2f91b25e8a5885441d17c9bf860fd1c84c0f9d0e8859e0cfde0831f1abd49a7c93aab8715899426dd5b1813"}}, {0x4, &(0x7f0000001040)=@lang_id={0x4, 0x3, 0x44e}}, {0x4, &(0x7f0000001080)=@lang_id={0x4, 0x3, 0x422}}]}) sendmsg$IEEE802154_LIST_PHY(r2, &(0x7f0000001200)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x14, r3, 0x10, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x460d8}, 0x40) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001280), r2) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001300)={&(0x7f00000012c0)={0x20, r4, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x41}, 0x4800) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000001380)={'wpan3\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$IEEE802154_LIST_IFACE(r7, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r8, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x80) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001540), r2) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f0000001640)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x5c, r9, 0x31c, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x60}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000004}, 0x42081) 22:27:35 executing program 6: syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x100) setns(0xffffffffffffffff, 0x4000000) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r0, 0x20, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x1a}, @val={0x8}, @val={0xc, 0x99, {0x200, 0x6e}}}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x34}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}]}, 0x48}}, 0x8001) r2 = ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x3000, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@fscache}], [{@audit}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000340)={{r3, r4+10000000}, {r5, r6+60000000}}, &(0x7f0000000380)) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000003c0)=""/236) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x34}}, 0x40801) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x34, r8, 0x800, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x101}]}, 0x34}, 0x1, 0x0, 0x0, 0x44884}, 0x8000) io_uring_setup(0x6e8b, &(0x7f0000000740)={0x0, 0x48e5, 0x20, 0x1, 0xfe}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) r10 = syz_open_procfs(0x0, &(0x7f00000007c0)='net/rpc\x00') io_uring_register$IORING_UNREGISTER_BUFFERS(r10, 0x1, 0x0, 0x0) 22:27:35 executing program 7: bind$bt_sco(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @none}, 0x8) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x80, r0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x80}, 0x1, 0x0, 0x0, 0x880}, 0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048041}, 0x44) r2 = socket(0x18, 0x1, 0x5) connect$bt_sco(r2, &(0x7f0000000300)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) ioctl$MON_IOCQ_URB_LEN(0xffffffffffffffff, 0x9201) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r3, &(0x7f0000000340)={0x1f, 0x4, @none, 0x8}, 0xe) socket(0x6, 0x80000, 0x1f) r4 = socket(0x1, 0x5, 0x7fffffff) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x20, 0x70bd29, 0x25dfdbfb, {}, [@GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20004041) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r5, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r6, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x24040081) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, r6, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x200050c4) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x20, r6, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0xc000) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000800)='pci\x00', &(0x7f0000000840)='\x00', 0x0) ioctl$MON_IOCT_RING_SIZE(0xffffffffffffffff, 0x9204, 0x3d092) 22:27:35 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_TID={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x20044801}, 0x20000000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x44000) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200)=@ccm_128={{0x304}, "f8cea6848869d065", "ca77eb81c9c90c677aa3c45a13ac6062", "34659732", "e62c0312d60d7017"}, 0x28) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000240)=@ccm_128={{0x7}, "3b881671b158c712", "136567a947514a4de33d780a9aac13c1", "7f4bbb1b", "d150044c57655d57"}, 0x28) ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000280)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000380), 0x4) r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x8000, 0x600d01) getsockopt$inet_tcp_int(r1, 0x6, 0x25, &(0x7f0000000400), &(0x7f0000000440)=0x4) socketpair(0x25, 0x6, 0x3b46edac, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000004c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000000500), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000540)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x4c, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x20008091) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x5c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8080}, 0x40000) sendmsg$IEEE802154_SET_MACPARAMS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x2c, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0xff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000800) getuid() ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000940)=0x8000) 22:27:35 executing program 1: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x80010, 0xffffffffffffffff, 0x8000000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) syz_io_uring_setup(0x71e1, &(0x7f00000000c0)={0x0, 0x37d1, 0x20, 0x3, 0x31a, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r3, 0x50a, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_NETNS_FD={0x8, 0x1d, r0}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4006}, 0x20000800) syz_genetlink_get_family_id$gtp(&(0x7f0000000300), r1) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000340)) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000380)) setns(r4, 0x0) syz_genetlink_get_family_id$fou(&(0x7f00000003c0), r1) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000400)='\x00', 0x0, 0xffffffffffffffff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r5, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000700)={&(0x7f0000000480)={0x250, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x110, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xab}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4842ca35}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x55}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x41b4e1df}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ab1b9a5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x10001}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x28}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1ad38da7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x516f5f91}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x37b199be}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6dc4a610}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x79b47f9e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x149f48c2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3e20a503}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1a603d97}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xac1b2bc}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8c}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8}, @NLBL_CIPSOV4_A_TAGLST={0x3c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x3}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x3}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x88, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe493}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x75c96a16}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x51f8}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x74137221}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x786}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x158c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1f43897d}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2a403a5e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcf8e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1bbef1dc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x41810d5c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7b82}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf9e2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd8f}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9a70}]}]}, @NLBL_CIPSOV4_A_DOI={0x8}]}, 0x250}, 0x1, 0x0, 0x0, 0x200408d0}, 0x8809) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000880)={&(0x7f0000000780), 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x68, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x40000) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x20, 0x0, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0xc0) 22:27:35 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x6) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000600)='ns/user\x00') bind$bt_sco(r1, &(0x7f0000000640)={0x1f, @none}, 0x8) r3 = semget$private(0x0, 0x3, 0x259) semctl$GETZCNT(r3, 0x1, 0xf, &(0x7f0000000680)=""/212) 22:27:35 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/90, &(0x7f00000000c0)=0x5a) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000100)=r0, 0x1) socketpair(0x1f, 0x6, 0x7, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(r0, 0x7dfa, 0x7f7b, 0x3, &(0x7f0000000180)={[0xfffffffffffffff7]}, 0x8) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xcc89e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x2040, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = io_uring_setup(0x4205, &(0x7f0000000240)={0x0, 0x695e, 0x20, 0x3, 0x272, 0x0, r2}) io_uring_register$IORING_REGISTER_PROBE(r3, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}]}, 0x4) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x802100}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008081}, 0x41) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000400)) getuid() r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000440)) r5 = syz_io_uring_setup(0x705a, &(0x7f0000000480)={0x0, 0xbca7, 0x0, 0x2, 0x194, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000500), &(0x7f0000000540)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f00000005c0)={0xffc, 0x0, &(0x7f0000000580)=[r5, 0xffffffffffffffff, r4]}, 0x3) r6 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000600)={0x1f, 0x0, @none}, &(0x7f0000000640)=0xe, 0x800) getsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, &(0x7f0000000680), &(0x7f00000006c0)=0xc) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x1, 0x0) ioctl$MON_IOCQ_RING_SIZE(r7, 0x9205) 22:27:35 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) fsmount(r0, 0x0, 0x6) syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x68, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x200540d1}, 0x10) 22:27:35 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/90, &(0x7f00000000c0)=0x5a) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000100)=r0, 0x1) socketpair(0x1f, 0x6, 0x7, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(r0, 0x7dfa, 0x7f7b, 0x3, &(0x7f0000000180)={[0xfffffffffffffff7]}, 0x8) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xcc89e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x2040, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = io_uring_setup(0x4205, &(0x7f0000000240)={0x0, 0x695e, 0x20, 0x3, 0x272, 0x0, r2}) io_uring_register$IORING_REGISTER_PROBE(r3, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}]}, 0x4) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x802100}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008081}, 0x41) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000400)) getuid() r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000440)) r5 = syz_io_uring_setup(0x705a, &(0x7f0000000480)={0x0, 0xbca7, 0x0, 0x2, 0x194, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000500), &(0x7f0000000540)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f00000005c0)={0xffc, 0x0, &(0x7f0000000580)=[r5, 0xffffffffffffffff, r4]}, 0x3) r6 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000600)={0x1f, 0x0, @none}, &(0x7f0000000640)=0xe, 0x800) getsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, &(0x7f0000000680), &(0x7f00000006c0)=0xc) openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x1, 0x0) [ 125.699934] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.716649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 22:27:35 executing program 6: syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x100) setns(0xffffffffffffffff, 0x4000000) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r0, 0x20, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x1a}, @val={0x8}, @val={0xc, 0x99, {0x200, 0x6e}}}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x34}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}]}, 0x48}}, 0x8001) r2 = ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x3000, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@fscache}], [{@audit}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000340)={{r3, r4+10000000}, {r5, r6+60000000}}, &(0x7f0000000380)) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000003c0)=""/236) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x34}}, 0x40801) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x34, r8, 0x800, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x101}]}, 0x34}, 0x1, 0x0, 0x0, 0x44884}, 0x8000) io_uring_setup(0x6e8b, &(0x7f0000000740)={0x0, 0x48e5, 0x20, 0x1, 0xfe}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) r10 = syz_open_procfs(0x0, &(0x7f00000007c0)='net/rpc\x00') io_uring_register$IORING_UNREGISTER_BUFFERS(r10, 0x1, 0x0, 0x0) 22:27:35 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x6) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000600)='ns/user\x00') bind$bt_sco(r1, &(0x7f0000000640)={0x1f, @none}, 0x8) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f0000000680)=""/212) 22:27:35 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/90, &(0x7f00000000c0)=0x5a) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000100)=r0, 0x1) socketpair(0x1f, 0x6, 0x7, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(r0, 0x7dfa, 0x7f7b, 0x3, &(0x7f0000000180)={[0xfffffffffffffff7]}, 0x8) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xcc89e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x2040, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = io_uring_setup(0x4205, &(0x7f0000000240)={0x0, 0x695e, 0x20, 0x3, 0x272, 0x0, r2}) io_uring_register$IORING_REGISTER_PROBE(r3, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}]}, 0x4) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x802100}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008081}, 0x41) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000400)) getuid() r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000440)) r5 = syz_io_uring_setup(0x705a, &(0x7f0000000480)={0x0, 0xbca7, 0x0, 0x2, 0x194, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000500), &(0x7f0000000540)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f00000005c0)={0xffc, 0x0, &(0x7f0000000580)=[r5, 0xffffffffffffffff, r4]}, 0x3) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000600)={0x1f, 0x0, @none}, &(0x7f0000000640)=0xe, 0x800) openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x1, 0x0) [ 125.906198] ------------[ cut here ]------------ [ 125.907068] WARNING: ./include/linux/ns_common.h:288 at nsproxy_ns_active_get+0x323/0x3d0, CPU#1: syz-executor.1/4099 [ 125.908718] Modules linked in: [ 125.909314] CPU: 1 UID: 0 PID: 4099 Comm: syz-executor.1 Not tainted 6.18.0-rc4-next-20251107 #1 PREEMPT(voluntary) [ 125.912574] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 125.915333] RIP: 0010:nsproxy_ns_active_get+0x323/0x3d0 [ 125.917388] Code: 00 01 0f 98 c3 31 ff 89 de e8 29 1f ab ff 84 db 75 07 5b 5d e9 4e 24 ab ff e8 49 24 ab ff 90 0f 0b 90 eb ee e8 3e 24 ab ff 90 <0f> 0b 90 e9 3f fd ff ff e8 30 24 ab ff 90 0f 0b 90 e9 92 fd ff ff [ 125.921500] RSP: 0018:ffff8880138efe08 EFLAGS: 00010212 [ 125.922326] RAX: 0000000000000b1a RBX: ffff8880097c3bc8 RCX: ffffc900019fc000 [ 125.923412] RDX: 0000000000040000 RSI: ffffffff81c9aaf2 RDI: 0000000000000001 [ 125.924505] RBP: ffff88801afe8401 R08: 0000000000000001 R09: ffffed10035fd097 [ 125.925587] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888016198e00 [ 125.926665] R13: 0000000000000000 R14: ffff888016da3780 R15: ffff8880138efe98 [ 125.927767] FS: 00007f28f1f8e700(0000) GS:ffff8880e5498000(0000) knlGS:0000000000000000 [ 125.928988] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.929881] CR2: 00007f28f1f8e718 CR3: 0000000009d6c000 CR4: 0000000000350ef0 [ 125.930969] Call Trace: [ 125.931363] [ 125.931720] switch_task_namespaces+0x3d/0x110 [ 125.932448] __do_sys_setns+0x6b0/0x19a0 [ 125.933092] ? __x64_sys_openat+0x142/0x200 [ 125.933751] ? __pfx___do_sys_setns+0x10/0x10 [ 125.934469] do_syscall_64+0xbf/0x430 [ 125.935086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.935897] RIP: 0033:0x7f28f4a5c107 [ 125.936462] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 125.939159] RSP: 002b:00007f28f1f8e128 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 125.940318] RAX: ffffffffffffffda RBX: 00007f28f4b6e0e0 RCX: 00007f28f4a5c107 [ 125.941402] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000ef [ 125.942482] RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000 [ 125.943570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.944649] R13: 00007ffd2520491f R14: 00007f28f1f8e300 R15: 0000000000022000 [ 125.945743] [ 125.946131] irq event stamp: 531 [ 125.946637] hardirqs last enabled at (539): [] __up_console_sem+0x78/0x80 [ 125.947932] hardirqs last disabled at (548): [] __up_console_sem+0x5d/0x80 [ 125.949223] softirqs last enabled at (198): [] handle_softirqs+0x50c/0x770 [ 125.950510] softirqs last disabled at (181): [] __irq_exit_rcu+0xc4/0x100 [ 125.951777] ---[ end trace 0000000000000000 ]--- [ 125.952625] ------------[ cut here ]------------ [ 125.953368] WARNING: ./include/linux/ns_common.h:288 at nsproxy_ns_active_get+0x331/0x3d0, CPU#1: syz-executor.1/4099 [ 125.954964] Modules linked in: [ 125.955494] CPU: 1 UID: 0 PID: 4099 Comm: syz-executor.1 Tainted: G W 6.18.0-rc4-next-20251107 #1 PREEMPT(voluntary) [ 125.957270] Tainted: [W]=WARN [ 125.957743] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 125.958975] RIP: 0010:nsproxy_ns_active_get+0x331/0x3d0 [ 125.959794] Code: 84 db 75 07 5b 5d e9 4e 24 ab ff e8 49 24 ab ff 90 0f 0b 90 eb ee e8 3e 24 ab ff 90 0f 0b 90 e9 3f fd ff ff e8 30 24 ab ff 90 <0f> 0b 90 e9 92 fd ff ff e8 22 24 ab ff 90 0f 0b 90 e9 e5 fd ff ff [ 125.966108] RSP: 0018:ffff8880138efe08 EFLAGS: 00010216 [ 125.969214] RAX: 000000000001a396 RBX: ffff8880097c3bc8 RCX: ffffc900019fc000 [ 125.970329] RDX: 0000000000040000 RSI: ffffffff81c9ab00 RDI: 0000000000000001 [ 125.971600] RBP: ffff88801b804501 R08: 0000000000000001 R09: ffffed1003700900 [ 125.972746] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888016198e00 [ 125.973837] R13: 0000000000000000 R14: ffff888016da3780 R15: ffff8880138efe98 [ 125.974923] FS: 00007f28f1f8e700(0000) GS:ffff8880e5498000(0000) knlGS:0000000000000000 [ 125.976156] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.977055] CR2: 00007f28f1f8e718 CR3: 0000000009d6c000 CR4: 0000000000350ef0 [ 125.978147] Call Trace: [ 125.978543] [ 125.978929] switch_task_namespaces+0x3d/0x110 [ 125.979638] __do_sys_setns+0x6b0/0x19a0 [ 125.980283] ? __x64_sys_openat+0x142/0x200 [ 125.980977] ? __pfx___do_sys_setns+0x10/0x10 [ 125.981663] do_syscall_64+0xbf/0x430 [ 125.982285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.983092] RIP: 0033:0x7f28f4a5c107 [ 125.983665] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 125.986393] RSP: 002b:00007f28f1f8e128 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 125.987558] RAX: ffffffffffffffda RBX: 00007f28f4b6e0e0 RCX: 00007f28f4a5c107 [ 125.988639] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000ef [ 125.989716] RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000 22:27:35 executing program 7: bind$bt_sco(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @none}, 0x8) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x80, r0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x80}, 0x1, 0x0, 0x0, 0x880}, 0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048041}, 0x44) r2 = socket(0x18, 0x1, 0x5) connect$bt_sco(r2, &(0x7f0000000300)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) ioctl$MON_IOCQ_URB_LEN(0xffffffffffffffff, 0x9201) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r3, &(0x7f0000000340)={0x1f, 0x4, @none, 0x8}, 0xe) socket(0x6, 0x80000, 0x1f) r4 = socket(0x1, 0x5, 0x7fffffff) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x20, 0x70bd29, 0x25dfdbfb, {}, [@GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20004041) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r5, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r6, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x24040081) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, r6, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x200050c4) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x20, r6, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0xc000) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000800)='pci\x00', &(0x7f0000000840)='\x00', 0x0) ioctl$MON_IOCT_RING_SIZE(0xffffffffffffffff, 0x9204, 0x3d092) 22:27:35 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x6) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000600)='ns/user\x00') semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f0000000680)=""/212) [ 125.990808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.992093] R13: 00007ffd2520491f R14: 00007f28f1f8e300 R15: 0000000000022000 [ 125.993175] [ 125.993530] irq event stamp: 2129 [ 125.994064] hardirqs last enabled at (2139): [] __up_console_sem+0x78/0x80 [ 125.995351] hardirqs last disabled at (2148): [] __up_console_sem+0x5d/0x80 [ 125.996671] softirqs last enabled at (1972): [] handle_softirqs+0x50c/0x770 [ 125.997958] softirqs last disabled at (1963): [] __irq_exit_rcu+0xc4/0x100 [ 125.999215] ---[ end trace 0000000000000000 ]--- [ 126.000064] ------------[ cut here ]------------ [ 126.000752] WARNING: ./include/linux/ns_common.h:288 at nsproxy_ns_active_get+0x33f/0x3d0, CPU#1: syz-executor.1/4099 [ 126.002314] Modules linked in: [ 126.002803] CPU: 1 UID: 0 PID: 4099 Comm: syz-executor.1 Tainted: G W 6.18.0-rc4-next-20251107 #1 PREEMPT(voluntary) [ 126.004609] Tainted: [W]=WARN [ 126.005107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 126.006329] RIP: 0010:nsproxy_ns_active_get+0x33f/0x3d0 [ 126.007152] Code: ab ff 90 0f 0b 90 eb ee e8 3e 24 ab ff 90 0f 0b 90 e9 3f fd ff ff e8 30 24 ab ff 90 0f 0b 90 e9 92 fd ff ff e8 22 24 ab ff 90 <0f> 0b 90 e9 e5 fd ff ff e8 14 24 ab ff 90 0f 0b 90 e9 38 fe ff ff [ 126.009838] RSP: 0018:ffff8880138efe08 EFLAGS: 00010212 [ 126.010621] RAX: 0000000000034399 RBX: ffff8880097c3bc8 RCX: ffffc900019fc000 [ 126.011708] RDX: 0000000000040000 RSI: ffffffff81c9ab0e RDI: 0000000000000001 [ 126.012777] RBP: ffff888016806001 R08: 0000000000000001 R09: ffffed1002d00d41 [ 126.013866] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888016198e00 [ 126.014939] R13: 0000000000000000 R14: ffff888016da3780 R15: ffff8880138efe98 [ 126.016032] FS: 00007f28f1f8e700(0000) GS:ffff8880e5498000(0000) knlGS:0000000000000000 [ 126.017233] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.018111] CR2: 00007f28f1f8e718 CR3: 0000000009d6c000 CR4: 0000000000350ef0 [ 126.019189] Call Trace: [ 126.019588] [ 126.019966] switch_task_namespaces+0x3d/0x110 [ 126.020658] __do_sys_setns+0x6b0/0x19a0 [ 126.021294] ? __x64_sys_openat+0x142/0x200 [ 126.021969] ? __pfx___do_sys_setns+0x10/0x10 [ 126.022651] do_syscall_64+0xbf/0x430 [ 126.023257] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.024054] RIP: 0033:0x7f28f4a5c107 [ 126.024612] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 126.027275] RSP: 002b:00007f28f1f8e128 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 126.028429] RAX: ffffffffffffffda RBX: 00007f28f4b6e0e0 RCX: 00007f28f4a5c107 [ 126.029506] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000ef [ 126.030573] RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000 [ 126.031649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.032710] R13: 00007ffd2520491f R14: 00007f28f1f8e300 R15: 0000000000022000 [ 126.033789] [ 126.034171] irq event stamp: 2545 [ 126.034680] hardirqs last enabled at (2553): [] __up_console_sem+0x78/0x80 [ 126.035977] hardirqs last disabled at (2562): [] __up_console_sem+0x5d/0x80 [ 126.037275] softirqs last enabled at (2344): [] handle_softirqs+0x50c/0x770 [ 126.038563] softirqs last disabled at (2339): [] __irq_exit_rcu+0xc4/0x100 [ 126.039850] ---[ end trace 0000000000000000 ]--- [ 126.040664] ------------[ cut here ]------------ [ 126.041375] WARNING: ./include/linux/ns_common.h:288 at nsproxy_ns_active_get+0x35b/0x3d0, CPU#1: syz-executor.1/4099 [ 126.042947] Modules linked in: [ 126.043435] CPU: 1 UID: 0 PID: 4099 Comm: syz-executor.1 Tainted: G W 6.18.0-rc4-next-20251107 #1 PREEMPT(voluntary) [ 126.045210] Tainted: [W]=WARN [ 126.045675] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 126.046905] RIP: 0010:nsproxy_ns_active_get+0x35b/0x3d0 [ 126.047715] Code: 0f 0b 90 e9 92 fd ff ff e8 22 24 ab ff 90 0f 0b 90 e9 e5 fd ff ff e8 14 24 ab ff 90 0f 0b 90 e9 38 fe ff ff e8 06 24 ab ff 90 <0f> 0b 90 e9 8b fe ff ff e8 f8 23 ab ff 90 0f 0b 90 e9 de fe ff ff [ 126.050372] RSP: 0018:ffff8880138efe08 EFLAGS: 00010246 [ 126.051187] RAX: 0000000000040000 RBX: ffff8880097c3bc8 RCX: ffffc900019fc000 [ 126.052273] RDX: 0000000000040000 RSI: ffffffff81c9ab2a RDI: 0000000000000001 [ 126.053342] RBP: ffff88800948b201 R08: 0000000000000001 R09: ffffed1001291657 [ 126.054413] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888016198e00 [ 126.055486] R13: 0000000000000000 R14: ffff888016da3780 R15: ffff8880138efe98 [ 126.056567] FS: 00007f28f1f8e700(0000) GS:ffff8880e5498000(0000) knlGS:0000000000000000 [ 126.057785] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.058680] CR2: 00007f28f1f8e718 CR3: 0000000009d6c000 CR4: 0000000000350ef0 [ 126.059760] Call Trace: [ 126.060176] [ 126.060520] switch_task_namespaces+0x3d/0x110 [ 126.061233] __do_sys_setns+0x6b0/0x19a0 [ 126.061872] ? __x64_sys_openat+0x142/0x200 [ 126.062521] ? __pfx___do_sys_setns+0x10/0x10 [ 126.063231] do_syscall_64+0xbf/0x430 [ 126.063842] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.067938] RIP: 0033:0x7f28f4a5c107 [ 126.068506] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 126.073469] RSP: 002b:00007f28f1f8e128 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 126.074637] RAX: ffffffffffffffda RBX: 00007f28f4b6e0e0 RCX: 00007f28f4a5c107 [ 126.075747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000ef [ 126.076835] RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000 [ 126.077912] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.078988] R13: 00007ffd2520491f R14: 00007f28f1f8e300 R15: 0000000000022000 [ 126.080083] [ 126.080439] irq event stamp: 4053 [ 126.080974] hardirqs last enabled at (4063): [] __up_console_sem+0x78/0x80 [ 126.082268] hardirqs last disabled at (4072): [] __up_console_sem+0x5d/0x80 [ 126.083574] softirqs last enabled at (4090): [] handle_softirqs+0x50c/0x770 [ 126.084857] softirqs last disabled at (4081): [] __irq_exit_rcu+0xc4/0x100 [ 126.086130] ---[ end trace 0000000000000000 ]--- 22:27:44 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x6) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f0000000680)=""/212) 22:27:44 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000000), 0x40, 0x11b000) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/152, &(0x7f0000000100)=0x98) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r2, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r0}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044000}, 0x24000080) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r1) r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000340)) r5 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x84, r3, 0x4, 0x70bd26, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, 0xffffffffffffffff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r5}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004}, 0x400c000) wait4(r5, &(0x7f00000004c0), 0xc0000000, &(0x7f0000000500)) write$rfkill(r0, &(0x7f00000005c0)={0x8000, 0x1, 0x0, 0x0, 0x1}, 0x8) sched_getaffinity(r5, 0x8, &(0x7f0000000600)) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010101}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @local}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x2b}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x8000080) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) fsmount(r0, 0x0, 0x6) syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) socketpair(0x2b, 0xa, 0x8, &(0x7f00000008c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x68, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x200540d1}, 0x10) 22:27:44 executing program 0: sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1109000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x800, 0x70bd25, 0x6, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040014}, 0x4008084) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_MLSCATLST={0x4c, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x95c0}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x42bb5d39}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xad8a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x534e3ff6}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x198c2a9e}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7557}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x700a}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x4000080) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x74, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x74}, 0x1, 0x0, 0x0, 0x40850}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_KEY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r3, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x1) syz_usb_connect(0x1, 0x554, &(0x7f0000000680)={{0x12, 0x1, 0x110, 0x76, 0x78, 0xe5, 0x10, 0x1410, 0x2100, 0x55c5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x542, 0x4, 0x40, 0x7, 0x40, 0x6, [{{0x9, 0x4, 0x90, 0x51, 0x1, 0xac, 0x72, 0x6, 0x5, [@uac_as={[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x9, 0x1, 0x2, 0x0, '+&'}, @as_header={0x7, 0x24, 0x1, 0x2, 0x3, 0x1001}]}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0xfbff}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x4978, 0x6, 0x7f}, {0x6, 0x24, 0x1a, 0x9, 0x20}, [@call_mgmt={0x5, 0x24, 0x1, 0x0, 0x1}, @mdlm={0x15, 0x24, 0x12, 0x6}, @country_functional={0x8, 0x24, 0x7, 0x7, 0x7, [0x657a]}, @network_terminal={0x7, 0x24, 0xa, 0x8, 0x9, 0x2}, @mbim={0xc, 0x24, 0x1b, 0x40, 0x80, 0x7f, 0x6, 0x7, 0x8}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x1, 0x3, 0x10}]}], [{{0x9, 0x5, 0xf, 0x3, 0x3bf, 0xab, 0x18, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x74f}, @generic={0x91, 0x11, "bac0e161202948ec0352c055ea0fc0ea3f3dd36c32d882b1dca88a2fd510d429f205db8a6d417d4c405cdabf7ce89a8539316fa81d42c76d019f0d839d1043323a7074c834b6446e6012afc951b1f70f73d4623f0eb6f1f2090a5153646a5056ab279871dfec6a8f179b907da6833d08fba2736a5aeae57b909f2d237e38be43a58cc723b93960d44effd4cb3ae5f0"}]}}]}}, {{0x9, 0x4, 0xbd, 0x20, 0xf, 0x22, 0x34, 0x2e, 0xa6, [@uac_as={[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xe1, 0x1, 0x8}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x9, 0x1, 0x1, 0xfe, "c60d"}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x8, 0x1, 0x9, 0x1, "620d1a", "09d32f"}]}], [{{0x9, 0x5, 0x4, 0x0, 0x400, 0x20, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x84, 0x0, 0x5}]}}, {{0x9, 0x5, 0xa, 0x4, 0x3ff, 0xfd, 0x4, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x8, 0x7}, @generic={0x17, 0x21, "2ab6e6d8e843f94a45aee885adc97744e96ed47c94"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x419ad0caf56b7c4e, 0x7f, 0x38, 0x1}}, {{0x9, 0x5, 0x8, 0x1, 0xc38, 0x2, 0x6, 0xa9, [@generic={0xd2, 0x4, "734208d94063a780db4b9fb5cb7228bc2248f67a4e98058855850bb8feaee163707711f1dabd3467be67fbf87bc14056d98d6449dc9c9c44fe81c8385c2743e71a8b268cc7b27d531d121046067a4e3539b5e37029ccaca7f49214fb9c6fa632aa56e1eab71ae6783604bf6684374637572ad4ec768c0f70fecbee726305b374266c3098de06ade06edcc72f056b19526ee57a1f1d13516b111ab3a168887655874dd7fae1f9b206b704a15c4e3402882cfa5b946e7fe54b7daef76ca41ff1ac7d1e66c98ee767d84fb2b43dfc5e35f3"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x8, 0x0, 0x9, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1f, 0x7ff}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0x0, 0x5, 0x3, [@generic={0xd5, 0x4, "c397e9d9bc483f0fce566f12039a7abc64cd09db48c79f9b3eca858ed2cb2fb45be87b939b7ace968fa25516ce0a87b0beea6888685bf4f4ed4458540629e24cff6c61de69f1d287570315365522267ac147ff746f218d08f1f5a9ca9a6e23d351d1ecfee6d075544cfbe3dd3052bd96e1bdda80ab7ca357d3deb132463d25750d6b4ca6e26018f237915a76f7e5bc68ae5a9888da9cc386d8e2f43e726783e0249d6768b652e6275ca244633fc5f449ded9028cbe92dc4d0b76b1186453a6280fa3e8804bceb80e85b09c83c2b9f82a60eae6"}]}}, {{0x9, 0x5, 0x7, 0x2, 0x20, 0x7f, 0x6, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x1}, @generic={0x63, 0xd, "a2f14b1758dd5270887c930565df4061bb255577c1a25308f3ca0b0dc3b4d09f0900b7581a13395c7aee6a06de82a7d6f34ad5f219aa3d7c311225aab1516f438649e1aa8b349a4aae4dc54fe002c46214387df5bc1e1ff68387564dfd86d6e48e"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x400, 0x24, 0x7f, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x5f}, @generic={0x9e, 0x6, "55f6432951db8e23837f06624f25d11c8d234f4af354faa30cfc6a1ec71c2a7e06489198193e0798a6b3ef7f63a33ac65a557894ed6e6c08c158b6cb34c3be66e345182945d1b38d97bd37a1b027a1de9323af96f21e9f588dec7c4c954ed0c8ea58d8c29466aaf66eacbc5dd07eb0283b0a1ee3ad358d31e2407c99997c025562f5becb4ee6898dffe69d4eaac3d0eedf05001a154a55922d5ddf47"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x3ff, 0x0, 0x64, 0x3f}}, {{0x9, 0x5, 0x2, 0x3, 0x0, 0x7, 0xeb, 0x2}}, {{0x9, 0x5, 0x9, 0x2, 0x40, 0x3, 0x3f, 0x3}}, {{0x9, 0x5, 0x7, 0x0, 0x400, 0xff, 0x2, 0x20}}, {{0x9, 0x5, 0xf, 0x0, 0x200, 0x4, 0x3, 0x81, [@generic={0x40, 0x3d, "8add444af55a89f72e08af111dc70b308f993aaa09a72a414707e38091fb249ab4f3607c04efed952872fdb222b0b17ca598622d65faa177f1fafcc142df"}]}}, {{0x9, 0x5, 0x5, 0x1, 0x20, 0x4, 0x1, 0xce}}, {{0x9, 0x5, 0xb, 0x8, 0x20, 0x20, 0xff, 0x1f}}]}}, {{0x9, 0x4, 0x50, 0x7f, 0x1, 0x1b, 0x1c, 0xef, 0x0, [], [{{0x9, 0x5, 0x8, 0x0, 0x8, 0x3, 0x1, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x3f, 0xc3}, @generic={0x31, 0x24, "d4a1b99e1db7a46effdb38aa5b73e822ad3e3c7c8b13f36deaf242a80e7844f1f13795f7a809bb4221dd0440a9a407"}]}}]}}, {{0x9, 0x4, 0x2c, 0x0, 0x0, 0xe0, 0x8c, 0xfd, 0xb6}}]}}]}}, &(0x7f00000010c0)={0xa, &(0x7f0000000c00)={0xa, 0x6, 0x0, 0x3, 0x0, 0x0, 0x20, 0x4}, 0x119, &(0x7f0000000c40)={0x5, 0xf, 0x119, 0x4, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x20, "4977db15f473c1fc1b5a91fecb30e173"}, @generic={0xe9, 0x10, 0x3, "99b84b20e1958db5b44aae3b6e59de1341b636d952acb34add1a846fc0860d6c39561b68d35973de4a53b78905eff788cb5a189d5b172ee354bf512d4ceb26bc28f35faf814dc49c94f992b85a867964f1635ed33247227d6aa6bc2e6e261d01f42a31d5d6a584779ce560413667ed266f89e0afd6a287e546394b4403f4d47953ec0496df6d49c26095a63de45b0d9c4fef799c00ed2e8e5227b12bac05e43d63bdb6fb8054b061a634547f0a5374f9f9820afd0079eb40cdb3f57a28f3b68b1276cd9586084960d36bd9df86332cb8e2a5f728ffbb586c0824967896a495301964bde99aa2"}, @ss_container_id={0x14, 0x10, 0x4, 0x7f, "6dbc7260d0129f6902b95a3e681c8613"}]}, 0x7, [{0xd5, &(0x7f0000000d80)=@string={0xd5, 0x3, "7ec053f6e4db026be2dbff5304612788da4ffea29beb5dce01d7dfa8d604cf64fb59bf1dd1edeb070db0481565949b5314ad58abe75ed08bbf74adb492603bea7fa6387fbd40c6772404bccbf7654f82b412304ae646275007a60575955e85e474edeaf5a58c8fab330526c8b54e46e2c0792ef2683f821e0303c614308469155434099dd1431b73760eaf860d9678b5553252df0b857c821b1c22a6a93302411d23b690a59c4ceb9f4f7d254e817f40876352ec53ab0d1217b02679fddbb2969c419b1828662f331626693a80784bf26e4baf"}}, {0x4, &(0x7f0000000e80)=@lang_id={0x4, 0x3, 0xc1a}}, {0x2d, &(0x7f0000000ec0)=@string={0x2d, 0x3, "bf9815ac2b2a468cc5cff2f3f60cb488dc0d90086dca1fbba3801d5053734c37be5f47808b37e7175b0b72"}}, {0x4, &(0x7f0000000f00)=@lang_id={0x4, 0x3, 0x424}}, {0xd7, &(0x7f0000000f40)=@string={0xd7, 0x3, "f310ea485163138a8439be47a78269b9f84b8d33d97b905765c70becb9bad2cfd4fc377c80b570cba77b94e5cbf0c34d1fa85bebe5507278e574d3cbaedc4f697982f8603070259e61851a04cd634d9ea4c55a68063e80582249a863fef85caa7cb2f8c9024f6df922282c9136770234e160c84d781ca1222c5f68bed4a5615688f8004466d5be31d4d2330caee8eaac6684ea6de679f054eecbb16de8d95124b7c29e4116d02453cbd2f91b25e8a5885441d17c9bf860fd1c84c0f9d0e8859e0cfde0831f1abd49a7c93aab8715899426dd5b1813"}}, {0x4, &(0x7f0000001040)=@lang_id={0x4, 0x3, 0x44e}}, {0x4, &(0x7f0000001080)=@lang_id={0x4, 0x3, 0x422}}]}) sendmsg$IEEE802154_LIST_PHY(r2, &(0x7f0000001200)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x14, r3, 0x10, 0x70bd25, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x460d8}, 0x40) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001280), r2) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r2, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001300)={&(0x7f00000012c0)={0x20, r4, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x41}, 0x4800) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000001380)={'wpan3\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$IEEE802154_LIST_IFACE(r7, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r8, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x80) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001540), r2) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f0000001640)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x5c, r9, 0x31c, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x60}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x7}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000004}, 0x42081) 22:27:44 executing program 7: bind$bt_sco(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @none}, 0x8) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x80, r0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x80}, 0x1, 0x0, 0x0, 0x880}, 0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048041}, 0x44) r2 = socket(0x18, 0x1, 0x5) connect$bt_sco(r2, &(0x7f0000000300)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) ioctl$MON_IOCQ_URB_LEN(0xffffffffffffffff, 0x9201) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r3, &(0x7f0000000340)={0x1f, 0x4, @none, 0x8}, 0xe) socket(0x6, 0x80000, 0x1f) r4 = socket(0x1, 0x5, 0x7fffffff) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x20, 0x70bd29, 0x25dfdbfb, {}, [@GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20004041) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r5, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r6, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x24040081) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, r6, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x200050c4) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x20, r6, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0xc000) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000800)='pci\x00', &(0x7f0000000840)='\x00', 0x0) 22:27:44 executing program 6: syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x100) setns(0xffffffffffffffff, 0x4000000) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r0, 0x20, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x1a}, @val={0x8}, @val={0xc, 0x99, {0x200, 0x6e}}}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x34}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}]}, 0x48}}, 0x8001) r2 = ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x3000, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@fscache}], [{@audit}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000340)={{r3, r4+10000000}, {r5, r6+60000000}}, &(0x7f0000000380)) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000003c0)=""/236) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x34}}, 0x40801) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x34, r8, 0x800, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x101}]}, 0x34}, 0x1, 0x0, 0x0, 0x44884}, 0x8000) io_uring_setup(0x6e8b, &(0x7f0000000740)={0x0, 0x48e5, 0x20, 0x1, 0xfe}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) syz_open_procfs(0x0, &(0x7f00000007c0)='net/rpc\x00') 22:27:44 executing program 1: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x80010, 0xffffffffffffffff, 0x8000000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) syz_io_uring_setup(0x71e1, &(0x7f00000000c0)={0x0, 0x37d1, 0x20, 0x3, 0x31a, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r3, 0x50a, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_NETNS_FD={0x8, 0x1d, r0}, @NL802154_ATTR_PID={0x8, 0x1c, 0xffffffffffffffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4006}, 0x20000800) syz_genetlink_get_family_id$gtp(&(0x7f0000000300), r1) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000340)) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000380)) setns(r4, 0x0) syz_genetlink_get_family_id$fou(&(0x7f00000003c0), r1) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f0000000400)='\x00', 0x0, 0xffffffffffffffff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r5, &(0x7f0000000740)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000700)={&(0x7f0000000480)={0x250, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x110, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xab}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4842ca35}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x55}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x41b4e1df}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6ab1b9a5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x10001}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x28}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1ad38da7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x516f5f91}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x37b199be}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6dc4a610}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x79b47f9e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x149f48c2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x25}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3e20a503}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1a603d97}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xac1b2bc}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8c}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8}, @NLBL_CIPSOV4_A_TAGLST={0x3c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x3}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x3}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x88, 0xc, 0x0, 0x1, [{0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe493}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x75c96a16}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x51f8}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x74137221}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x786}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x158c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1f43897d}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2a403a5e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcf8e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1bbef1dc}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x41810d5c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7b82}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf9e2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbd8f}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9a70}]}]}, @NLBL_CIPSOV4_A_DOI={0x8}]}, 0x250}, 0x1, 0x0, 0x0, 0x200408d0}, 0x8809) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000880)={&(0x7f0000000780), 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x68, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x40000) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x20, 0x0, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0xc0) 22:27:44 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_TID={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x20044801}, 0x20000000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x44000) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200)=@ccm_128={{0x304}, "f8cea6848869d065", "ca77eb81c9c90c677aa3c45a13ac6062", "34659732", "e62c0312d60d7017"}, 0x28) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000240)=@ccm_128={{0x7}, "3b881671b158c712", "136567a947514a4de33d780a9aac13c1", "7f4bbb1b", "d150044c57655d57"}, 0x28) ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, &(0x7f0000000280)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000380), 0x4) r1 = syz_open_dev$mouse(&(0x7f00000003c0), 0x8000, 0x600d01) getsockopt$inet_tcp_int(r1, 0x6, 0x25, &(0x7f0000000400), &(0x7f0000000440)=0x4) socketpair(0x25, 0x6, 0x3b46edac, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000004c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000000500), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000540)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_KEY(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x4c, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x20008091) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x5c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8080}, 0x40000) sendmsg$IEEE802154_SET_MACPARAMS(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x2c, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0xff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000800) getuid() ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000940)=0x8000) 22:27:44 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/90, &(0x7f00000000c0)=0x5a) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000100)=r0, 0x1) socketpair(0x1f, 0x6, 0x7, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(r0, 0x7dfa, 0x7f7b, 0x3, &(0x7f0000000180)={[0xfffffffffffffff7]}, 0x8) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xcc89e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x2040, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = io_uring_setup(0x4205, &(0x7f0000000240)={0x0, 0x695e, 0x20, 0x3, 0x272, 0x0, r2}) io_uring_register$IORING_REGISTER_PROBE(r3, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}]}, 0x4) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x802100}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008081}, 0x41) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000400)) getuid() r4 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000440)) r5 = syz_io_uring_setup(0x705a, &(0x7f0000000480)={0x0, 0xbca7, 0x0, 0x2, 0x194, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000500), &(0x7f0000000540)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r2, 0x6, &(0x7f00000005c0)={0xffc, 0x0, &(0x7f0000000580)=[r5, 0xffffffffffffffff, r4]}, 0x3) openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x1, 0x0) [ 135.275475] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.287527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 22:27:45 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000005c0)={0x1c, 0x0, &(0x7f0000000540)=[@release, @enter_looper, @request_death], 0x40, 0x0, &(0x7f0000000580)="98189e599b4eeaedce554ccf976f1770701eb3c034c72e4514940b2b7b260c386939183615f4dfe5d63d974f25ac74b5789af6e2cd6472f2673f61a7696630e9"}) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f0000000680)=""/212) 22:27:45 executing program 6: syz_open_dev$usbmon(&(0x7f0000000000), 0x4, 0x100) setns(0xffffffffffffffff, 0x4000000) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = fsmount(0xffffffffffffffff, 0x0, 0x8) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r0, 0x20, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x1, 0x1a}, @val={0x8}, @val={0xc, 0x99, {0x200, 0x6e}}}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x34}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r1}]}, 0x48}}, 0x8001) r2 = ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x3000, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@fscache}], [{@audit}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000340)={{r3, r4+10000000}, {r5, r6+60000000}}, &(0x7f0000000380)) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000003c0)=""/236) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x34, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x34}}, 0x40801) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x34, r8, 0x800, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x101}]}, 0x34}, 0x1, 0x0, 0x0, 0x44884}, 0x8000) io_uring_setup(0x6e8b, &(0x7f0000000740)={0x0, 0x48e5, 0x20, 0x1, 0xfe}) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) syz_open_procfs(0x0, &(0x7f00000007c0)='net/rpc\x00') 22:27:45 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000000040)=""/90, &(0x7f00000000c0)=0x5a) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000100)=r0, 0x1) socketpair(0x1f, 0x6, 0x7, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_enter(r0, 0x7dfa, 0x7f7b, 0x3, &(0x7f0000000180)={[0xfffffffffffffff7]}, 0x8) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0xcc89e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x2040, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = io_uring_setup(0x4205, &(0x7f0000000240)={0x0, 0x695e, 0x20, 0x3, 0x272, 0x0, r2}) io_uring_register$IORING_REGISTER_PROBE(r3, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}]}, 0x4) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x802100}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008081}, 0x41) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000400)) getuid() syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000440)) syz_io_uring_setup(0x705a, &(0x7f0000000480)={0x0, 0xbca7, 0x0, 0x2, 0x194, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000500), &(0x7f0000000540)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000700), 0x1, 0x0) [ 135.519348] ------------[ cut here ]------------ [ 135.520526] WARNING: ./include/linux/ns_common.h:288 at nsproxy_ns_active_get+0x369/0x3d0, CPU#1: syz-executor.1/4166 [ 135.522640] Modules linked in: [ 135.523282] CPU: 1 UID: 0 PID: 4166 Comm: syz-executor.1 Tainted: G W 6.18.0-rc4-next-20251107 #1 PREEMPT(voluntary) [ 135.525373] Tainted: [W]=WARN [ 135.525956] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 135.527429] RIP: 0010:nsproxy_ns_active_get+0x369/0x3d0 [ 135.528449] Code: 0f 0b 90 e9 e5 fd ff ff e8 14 24 ab ff 90 0f 0b 90 e9 38 fe ff ff e8 06 24 ab ff 90 0f 0b 90 e9 8b fe ff ff e8 f8 23 ab ff 90 <0f> 0b 90 e9 de fe ff ff e8 ea 23 ab ff 90 0f 0b 90 e9 31 ff ff ff [ 135.531659] RSP: 0018:ffff888018d8fe08 EFLAGS: 00010212 [ 135.532644] RAX: 000000000001ba3e RBX: ffff8880097c3d00 RCX: ffffc90001fff000 [ 135.533938] RDX: 0000000000040000 RSI: ffffffff81c9ab38 RDI: 0000000000000001 [ 135.535208] RBP: ffff888016fcb001 R08: 0000000000000001 R09: ffffed1002df9652 [ 135.536487] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880169dae00 [ 135.537766] R13: 0000000000000000 R14: ffff888016268000 R15: ffff888018d8fe98 [ 135.539056] FS: 00007f28f1f6d700(0000) GS:ffff8880e5498000(0000) knlGS:0000000000000000 [ 135.540495] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.541544] CR2: 00007fae8dd686f4 CR3: 0000000020381000 CR4: 0000000000350ef0 [ 135.542844] Call Trace: [ 135.543318] [ 135.543737] switch_task_namespaces+0x3d/0x110 [ 135.544601] __do_sys_setns+0x6b0/0x19a0 [ 135.545364] ? __sys_socket+0x9f/0x260 [ 135.546093] ? __pfx___do_sys_setns+0x10/0x10 [ 135.546934] do_syscall_64+0xbf/0x430 [ 135.547630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.548567] RIP: 0033:0x7f28f4a5c107 [ 135.549259] Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 135.552445] RSP: 002b:00007f28f1f6d128 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 135.553808] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00007f28f4a5c107 [ 135.555107] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000006 [ 135.556387] RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000 [ 135.557656] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f28f1f6d6bc [ 135.558920] R13: 000000000000000e R14: 00007f28f1f6d300 R15: 0000000000022000 [ 135.560227] [ 135.560652] irq event stamp: 1185 [ 135.561286] hardirqs last enabled at (1195): [] __up_console_sem+0x78/0x80 [ 135.562812] hardirqs last disabled at (1204): [] __up_console_sem+0x5d/0x80 [ 135.564381] softirqs last enabled at (1038): [] handle_softirqs+0x50c/0x770 [ 135.565906] softirqs last disabled at (1033): [] __irq_exit_rcu+0xc4/0x100 [ 135.567404] ---[ end trace 0000000000000000 ]--- 22:27:45 executing program 3: setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000000)=0x2, 0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000040)=0x100000) mmap$binder(&(0x7f0000fee000/0x11000)=nil, 0x11000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000200)=0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000240)=0x401) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x200000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000002c0)=0x9f) r2 = syz_open_dev$sg(&(0x7f0000000300), 0x0, 0x80) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000500)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x120, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xee}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000001}, 0x8080) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f0000000680)=""/212) 22:27:45 executing program 7: bind$bt_sco(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @none}, 0x8) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x80, r0, 0x400, 0x70bd26, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x80}, 0x1, 0x0, 0x0, 0x880}, 0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_NET_NS_FD={0x8, 0x7, r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048041}, 0x44) r2 = socket(0x18, 0x1, 0x5) connect$bt_sco(r2, &(0x7f0000000300)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) ioctl$MON_IOCQ_URB_LEN(0xffffffffffffffff, 0x9201) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r3, &(0x7f0000000340)={0x1f, 0x4, @none, 0x8}, 0xe) socket(0x6, 0x80000, 0x1f) r4 = socket(0x1, 0x5, 0x7fffffff) sendmsg$GTP_CMD_GETPDP(r4, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x0, 0x20, 0x70bd29, 0x25dfdbfb, {}, [@GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x20004041) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r5, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r6, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x24040081) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, r6, 0x400, 0x70bd29, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x200050c4) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000800)='pci\x00', &(0x7f0000000840)='\x00', 0x0) VM DIAGNOSIS: 22:27:35 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=0000000000000001 RCX=ffffffff819f0215 RDX=ffff88800e720000 RSI=0000000000000008 RDI=ffffea0000dd6bc0 RBP=ffffea0000dd6bc0 RSP=ffff888013a9f628 R8 =0000000000000000 R9 =fffff940001bad76 R10=0000000000000001 R11=0000000000000001 R12=80000000375af007 R13=ffff888013a9faa8 R14=ffff88800e37b210 R15=dffffc0000000000 RIP=ffffffff81b27fa8 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e5398000 00000000 00000000 LDT=0000 fffffe2500000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f2998d7b620 CR3=0000000020804000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000065 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff82935405 RDI=ffffffff8896b880 RBP=ffffffff8896b840 RSP=ffff8880138ef6b0 R8 =0000000000000000 R9 =ffffed1001703046 R10=0000000000000065 R11=0000000000000001 R12=0000000000000065 R13=0000000000000010 R14=ffffffff8896b840 R15=ffffffff829353f0 RIP=ffffffff8293545d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f28f1f8e700 00000000 00000000 GS =0000 ffff8880e5498000 00000000 00000000 LDT=0000 fffffe3300000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f28f1f8e718 CR3=0000000009d6c000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f28f4b417c000007f28f4b417c8 XMM02=00007f28f4b417e000007f28f4b417c0 XMM03=00007f28f4b417c800007f28f4b417c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000