40)=[{{&(0x7f0000000000)=@nfc, 0x80, &(0x7f0000000600)=[{&(0x7f0000000140)=""/232, 0xe8}, {&(0x7f0000000240)=""/239, 0xef}, {&(0x7f0000000340)=""/236, 0xec}, {&(0x7f0000000440)=""/179, 0xb3}, {&(0x7f0000000080)=""/94, 0x5e}, {&(0x7f0000000500)=""/231, 0xe7}], 0x6, &(0x7f0000000680)=""/92, 0x5c}, 0x9}, {{&(0x7f0000000700)=@xdp, 0x80, &(0x7f0000001900)=[{&(0x7f0000000780)=""/142, 0x97}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000001840)=""/137, 0x89}], 0x3, &(0x7f0000001940)=""/254, 0xfe}, 0x6}, {{0x0, 0x0, &(0x7f0000004d80)=[{&(0x7f0000001a40)=""/136, 0x88}, {&(0x7f0000001b00)=""/162, 0xa2}, {&(0x7f0000001bc0)=""/201, 0xc9}, {&(0x7f0000001cc0)=""/4096, 0x1000}, {&(0x7f0000002cc0)=""/4096, 0x1000}, {&(0x7f0000003cc0)=""/4096, 0x1000}, {&(0x7f0000004cc0)=""/10, 0xa}, {&(0x7f0000005180)=""/77, 0x4d}], 0x8, &(0x7f0000004e00)=""/16, 0x10}, 0x6}], 0x3, 0x40, &(0x7f0000005140)={0x0, 0x3938700}) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000004f40), 0x199000, 0x0) accept4(r1, 0x0, &(0x7f0000004f80), 0x80800) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) r2 = perf_event_open$cgroup(&(0x7f0000005000)={0x1, 0x80, 0x67, 0xa0, 0x1f, 0x7, 0x0, 0x2, 0x21000, 0x8, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x93, 0x0, @perf_bp={&(0x7f0000004fc0), 0x5}, 0x1, 0x8, 0x1000, 0x5, 0x8, 0x0, 0x9, 0x0, 0x2, 0x0, 0x9}, r1, 0x0, r1, 0x8) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r2, 0x80489439, &(0x7f0000005080)) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) openat$cgroup_subtree(r3, &(0x7f0000005100), 0x2, 0x0) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r4, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30c) waitid$P_PIDFD(0x3, r4, &(0x7f0000004d00), 0x80000000, &(0x7f0000005200)) 18:11:37 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:11:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:11:37 executing program 5: ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2ab2}}, './file0\x00'}) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) renameat2(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00', 0x1) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r2, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:11:37 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x0, 0x2}, 0xe) 18:11:37 executing program 1: bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x8b, @none, 0x201}, 0xe) close(0xffffffffffffffff) 18:11:37 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, &(0x7f0000000000)={{}, 0x4, 0x0, 0x7fffffff}) 18:11:54 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:11:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:11:54 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {0x3f}}, './file0\x00'}) 18:11:54 executing program 1: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8}}, './file0\x00'}) sendmmsg$inet(r0, &(0x7f0000000400)=[{{&(0x7f0000000040)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000080)="489669aafc76aaf2bd421efd8831e7fb9991af3bfcb6fa509e491a9c43a11af0b2ded5f56515da27d3e4", 0x2a}, {&(0x7f0000000140)="ad4b05da90654260fd3a13ed0fac8f8dd938c9fc73487de4ee2c3f1fb61a88dff8934fc5654cf26b69b16c7cf6a475ff4808f0e3d63c3ed47e605bf25c5ba83d5f71b132873be0bda276c30f52d54b8fe8d163b6f45d47eedd8900a47b9fece573c8e260904ca733d7b0c89078c7fc6d179fe24a6f46e1fc83e66ba1e86b62e6974f3e23faa69a89d61443f0931b221466865fc0570566ffd93a7b4fbb664f66432734ea5d077acbaf5ccd344cdf2ba341ec52acb98257793f956469aacb16cafae1cf3839ed328fdc283b36", 0xcc}, {&(0x7f0000000240)="ee33930b4d7c83651d70d18f829e7ebbb5672e8826f485defb546e8c079d44305bb979bdb8aa04ae52223a8332eff458bf31164c530df76b0e8be8d10fdea6fd052c68916b10a015f41993d9c1095b3ebf9609265438c5d510e3b37fbf6796e43266712c5e16141a1e7c50d62270abcbd7f36ccbf6b121c907b7e722b3e5a78fc2aee61b8a1b782e8fa2bd9c5f6d9bc54da8c69f602b780f7fd78b388958cae68bfe9d46579eb909b7293c075f073ec95740077c6de6bfd1fb622acd67eaf271430f5da374bf605060ccca6ff4d746b905e360e79f0f98e743e8", 0xda}, {&(0x7f0000000340)="d9caada59bb70d1f4d79da559ccc67d305f4a072c2943f3a8e94c76027a8491ce8fda57d0c19caadb9722004eec01155031d736d7bbf08b34fc578a7ea10f0e854c2cf1342077f158820", 0x4a}], 0x4, &(0x7f00000003c0)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xbd}}], 0x30}}], 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) 18:11:54 executing program 2: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB]) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:11:54 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:11:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = dup3(0xffffffffffffffff, r0, 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000040)) ioctl$BTRFS_IOC_SPACE_INFO(0xffffffffffffffff, 0xc0109414, &(0x7f0000001040)={0xf0b, 0xffffffff, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000000)) 18:11:54 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) fgetxattr(r0, &(0x7f0000000000)=@random={'osx.', '\x00'}, &(0x7f0000000040), 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) 18:11:54 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/custom0\x00', 0x800, 0x0) sendfile(r3, r4, &(0x7f00000000c0)=0x6f53, 0x8) ioctl$BTRFS_IOC_SPACE_INFO(r2, 0xc0109414, &(0x7f0000000680)={0x9e6, 0x6, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x1, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x208401, 0x0) 18:12:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:13 executing program 2: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) r2 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) r3 = dup3(r0, r0, 0x80000) ioctl$BTRFS_IOC_RESIZE(r2, 0x50009403, &(0x7f0000000280)={{r3}, {@void, @actul_num={@val=0x3e, 0x401, 0x74}}}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) pread64(r1, &(0x7f0000000100)=""/203, 0xcb, 0x0) write$selinux_attr(r0, 0x0, 0x0) 18:12:13 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x301002) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) fsetxattr(r0, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)='/dev/sg#\x00', 0x9, 0x2) 18:12:13 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) close(r0) 18:12:13 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) 18:12:13 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:13 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0xa, 0x802) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:12:13 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:12:13 executing program 2: r0 = epoll_create(0x8000) r1 = dup2(r0, r0) r2 = inotify_init() r3 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000080)={0x3ff, 0xf7, 0x0, 0x50fb, 0x2, [{0x1000, 0x100, 0x80000000, '\x00', 0x200}, {0xffffffffffff8001, 0x8, 0x4, '\x00', 0x1200}]}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000040)={0x10000008}) 18:12:13 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) preadv(r0, &(0x7f0000000400)=[{}, {&(0x7f0000000040)=""/8, 0x8}, {&(0x7f0000000080)=""/186, 0xba}, {&(0x7f0000000140)}, {&(0x7f0000000180)=""/172, 0xac}, {&(0x7f0000000280)=""/143, 0x8f}, {&(0x7f0000000340)=""/166, 0xa6}], 0x7, 0x80000000, 0x3) 18:12:13 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = syz_open_dev$vcsu(&(0x7f0000000000), 0x7, 0x0) shutdown(r1, 0x1) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x0, @any, 0xe00, 0x2}, 0xfffffffffffffe58) 18:12:13 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x8, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) r2 = open(&(0x7f0000000040)='./file0\x00', 0x100, 0x8) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00'}) ioctl$BTRFS_IOC_GET_FEATURES(r1, 0x80189439, &(0x7f0000000000)) 18:12:13 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:13 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = accept4(r0, &(0x7f0000000000)=@alg, &(0x7f0000000080)=0x80, 0x80800) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000140)=0x1, &(0x7f0000000180)=0x4) shutdown(r1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) 18:12:13 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x183000, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000080)=0xc, 0x4) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x8, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000001000000180000f37eacccd75360160f1e00", @ANYRES32=r2, @ANYBLOB="05000000000000002e2f66696c653000"]) connect$bt_l2cap(r3, &(0x7f00000001c0)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xfffa, 0x2}, 0xe) socket$inet6(0xa, 0x5, 0x7) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r4, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30c) ioctl$FICLONERANGE(r4, 0x4020940d, &(0x7f00000000c0)={{r0}, 0xffffffffffffffff, 0x0, 0xfffffffffffffffb}) 18:12:13 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x5044]}, 0x8, 0x80000) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000007280)=[{{&(0x7f0000000040), 0x6e, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/173, 0xad}, {&(0x7f0000000500)=""/10, 0xa}], 0x2, &(0x7f0000000280)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000000300)=@abs, 0x6e, &(0x7f0000000380)=[{&(0x7f0000000200)=""/57, 0x39}], 0x1, &(0x7f00000003c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0}}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa0}}, {{&(0x7f0000000480), 0x6e, &(0x7f0000000700)}}, {{&(0x7f0000000780)=@abs, 0x6e, &(0x7f0000000800), 0x0, &(0x7f0000000840)}}, {{&(0x7f0000000880)=@abs, 0x6e, &(0x7f0000000a40)=[{&(0x7f0000000900)=""/114, 0x72}, {&(0x7f0000000980)=""/189, 0xbd}], 0x2}}, {{&(0x7f0000000a80)=@abs, 0x6e, &(0x7f0000000d80)=[{&(0x7f0000000180)=""/53, 0x35}, {&(0x7f0000000b40)=""/227, 0xe3}, {&(0x7f0000000c40)=""/49, 0x31}, {&(0x7f0000002040)=""/4096, 0x1000}, {&(0x7f0000000c80)=""/139, 0x8b}, {&(0x7f0000000d40)=""/30, 0x1e}, {&(0x7f0000003040)=""/4096, 0x1000}, {&(0x7f0000004040)=""/4096, 0x1000}], 0x8, &(0x7f0000000e00)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x30}}, {{0x0, 0x0, &(0x7f0000005200)=[{&(0x7f0000000e40)=""/188, 0xbc}, {&(0x7f0000000f00)=""/173, 0xad}, {&(0x7f0000005040)=""/170, 0xaa}, {&(0x7f0000000fc0)=""/25, 0x19}, {&(0x7f0000005100)=""/247, 0xf7}], 0x5, &(0x7f0000005280)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x90}}, {{&(0x7f0000005340), 0x6e, &(0x7f0000005940)=[{&(0x7f00000053c0)=""/6, 0x6}, {&(0x7f0000005400)=""/125, 0x7d}, {&(0x7f0000005480)=""/157, 0x9d}, {&(0x7f0000007740)=""/104, 0x68}, {&(0x7f00000055c0)=""/246, 0xf6}, {&(0x7f00000056c0)=""/221, 0xdd}, {&(0x7f00000057c0)=""/128, 0x80}, {&(0x7f0000005840)=""/240, 0xf0}], 0x8}}, {{&(0x7f00000059c0), 0x6e, &(0x7f0000006c00)=[{&(0x7f0000005a40)=""/4096, 0x1000}, {&(0x7f00000077c0)=""/192, 0xc0}, {&(0x7f0000006b00)=""/20, 0x14}, {&(0x7f0000006b40)=""/176, 0xb0}], 0x4, &(0x7f0000000540)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x40, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x148}}, {{0x0, 0x0, &(0x7f0000007180)=[{&(0x7f0000006d80)=""/174, 0xae}, {&(0x7f0000006e40)=""/224, 0xe0}, {&(0x7f0000006f40)=""/194, 0xc2}, {&(0x7f0000007040)=""/223, 0xdf}, {&(0x7f0000007140)=""/33, 0x21}], 0x5, &(0x7f0000007200)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}], 0xa, 0x2000, &(0x7f0000007500)={0x0, 0x989680}) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000007540)={'\x00', 0x6, 0x80, 0x7, 0x6, 0x8, r2}) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r3 = socket$inet6_udp(0xa, 0x2, 0x0) readv(r3, &(0x7f0000007700)=[{&(0x7f0000000800)=""/25, 0x19}, {&(0x7f0000000840)=""/40, 0x28}, {&(0x7f00000075c0)=""/22, 0x16}, {&(0x7f0000007600)=""/206, 0xce}], 0x4) 18:12:32 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:32 executing program 5: timer_settime(0x0, 0x0, &(0x7f0000000080)={{}, {0x77359400}}, &(0x7f00000000c0)) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) r0 = syz_open_dev$sg(&(0x7f0000001000), 0x1, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) timer_settime(0x0, 0x1, &(0x7f0000000100)={{0x0, 0x989680}, {0x77359400}}, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000180)={{r1, r2+10000000}, {0x77359400}}, &(0x7f00000001c0)) socket$unix(0x1, 0x5, 0x0) 18:12:32 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:12:32 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/locks\x00', 0x0, 0x0) close(0xffffffffffffffff) r1 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) signalfd4(r1, &(0x7f0000000000)={[0x6]}, 0x8, 0x800) open_by_handle_at(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="d51a1f388d1d409360d80000ae0c10f7208efa92039b0fe25194c45da5149c95b241db2e4118bf8b48d0b99ab324606a9ea306f1101e9130fda73f2eb294b4648ff5f1b1d180367cb93ae3c3879591b7fa95be045c2d006ffa26579aa22cac4eebc3a5fa037c31c91d7702d74b6a4e9eff6a138316f4c58d4d4d0c2dd37a405de7227fec60719022dc7433d25a9e7b121f5a141ac080ee98a1510326560a4cb32d30b77a40ca6f7c22c8bea33ea0bc826139058007eed74f"], 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0) r3 = eventfd2(0x8001, 0x0) r4 = fsmount(0xffffffffffffffff, 0x0, 0x7) symlinkat(&(0x7f0000000000)='.\x00', r4, &(0x7f00000001c0)='./file0\x00') io_submit(0x0, 0x2, &(0x7f0000000580)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, &(0x7f0000000300)="7d0cbd3867c829861b4a3f6680fdf1146625eee73795be48a231c2e8a4e080df9fb28ef76cf3bd57340803deec7a6186d66b77d343a76577b5c9a390e3a5fa6a94a7828d214d88dffbc837d9d799cd064c091999a8c86f572b18727c7196b87099543e3d9891c980b2cdf3cde486ed152019a8070e145190a6c234de901a6b18e5f13dcf99fa4d439a7fe36af1d7c414b5411159002c6db848b08305336e91c9d223f49f652bf3fd3069a6e65a9bcf445cb8155665370ecabab8283ce6401dfd12cf2ea8d44a94b1c14e9a5dfa2a4e9eb9a25d64", 0xd4, 0x3, 0x0, 0x2, r0}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x8, 0x4, 0xffffffffffffffff, &(0x7f0000000480)="ccaea0f4cc77d7d48fc65fa5ff2509e5d73e39c22cedd3cefc204ad3ddfdc3df34bb2acd0487ba54e7dff6ceb9fd9ef3f3f3c271ae3ba47f478cf9354ad0a5007f03ba9d1c219d73e5add7e461e261c053485ceb11c81a0ab6daa3f085e07ee841deabcbe0648c651a67bf289141f73271d987dc84e8bbecab7f4d90b9c9cd092c5f6db992c5d5d2fc091221db5289b539329b4ca048d2c2e09fc50d3ed44dfdeca0fb89878ae94cff2336a860a84ebb2ac8c5bc9b6ad20f3c8c64d4e978efcce81dc5d2522c2b1e9a709206448f4322053706f7e2f686ecde", 0xd9, 0xc59a, 0x0, 0x2, r4}]) io_setup(0x7, &(0x7f00000001c0)=0x0) io_submit(r5, 0x1, &(0x7f0000000040)=[&(0x7f0000000440)={0x0, 0x0, 0x0, 0x5, 0xffff, r3, 0x0, 0x0, 0xffffffffffffffde, 0x0, 0x0, r3}]) fallocate(r3, 0x23, 0x200, 0x6) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) fallocate(r6, 0x0, 0x0, 0x87ffffc) fcntl$dupfd(0xffffffffffffffff, 0x1193f424852396c6, 0xffffffffffffffff) 18:12:32 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = accept4(0xffffffffffffffff, &(0x7f0000000080)=@isdn, &(0x7f0000000100)=0x80, 0x80000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'veth0_virt_wifi\x00'}) dup2(r0, 0xffffffffffffffff) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) lsetxattr$security_ima(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000200)=@md5={0x1, "1c1779994aabac0749b7ffcab8606544"}, 0x11, 0x1) r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x1) ioctl$GIO_FONT(r2, 0x4b60, &(0x7f0000000040)=""/59) 18:12:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:32 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'veth1_to_batadv\x00'}) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) bind$bt_l2cap(r1, &(0x7f00000000c0)={0x1f, 0x5, @any, 0x8000}, 0xe) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000000), &(0x7f0000000040)=0x40) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) 18:12:32 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000000)=0x4, 0x4) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) sendmmsg$inet6(r2, &(0x7f0000001e40)=[{{&(0x7f0000000080)={0xa, 0x4e20, 0x1f, @mcast2, 0x1000}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000140)="4a65cb32873d1fc95151524fe3b8631695cab576d0e1168776ca6be08bc0e5be2386b64ccfb52c3e30f9e6335624563fcbf74ecee016d697b81851224504ea7f94eb1aabbfc924ed85cf3b45345c68544a4c80038cdf8257c38c99f41c4a0f83a6", 0x61}, {&(0x7f00000001c0)="07b4984ca39aa73b9bd3a6ef8e245a2a2d8bb564e6c78752e3a3164817e691fee6d2992877cf2184b684579fcaf516af9673f582971181fff32ca142a2b18762879d502940c518577f505ed3e08bbfa47a12b6eece2e", 0x56}, {&(0x7f0000000240)="b39a1bc97eae282333b49e63aa55966cd73651b8c7cbb0f0c7c871b3f68b7a6666bb4699eb5c24d3c690ba53b80e8cc44595afdde71dd56133d4ee0f7e11d5834b310069c99344925d4b64af33ba11a564fc6bda00d98daa9b1ede3e77dc69cfef86f2a04c4aa50cdfc804ec956231", 0x6f}, {&(0x7f00000000c0)="496d77d524344d4123b43d5fdb9c05829c6dd564b8dcd338ddecd4e3403ec8e80e38a655eedf0d6d", 0x28}], 0x4, &(0x7f0000000300)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0xb9a7}}], 0x18}}, {{&(0x7f0000000340)={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0x9e6}, 0x1c, &(0x7f0000000740)=[{&(0x7f0000000380)="aef4dcb81002e1e6506570d569812d40a2735eda9e50f46d30de99c2b60af0f92aafdd1333336eae74d5f66cbc1eff402bdb07710eeaf496fa479574c4a84643233a4af785ad58a8f88446f0d436a8beaa920693050f898c385e", 0x5a}, {&(0x7f0000000400)="883b077a70b5aa535e0c6e11469ec867090be1e438b79b49abcf89d4949d98489484226cda79c886ab3bda56f0acc7250eebe04cd232abbb69bde41fc3acd6978c197933472b1c0a179d42f319d475e937964c542e0cb1b3bf1476e763bebe1d6f3c173a05f56d9790b9de82310d30c483d3abf07706e68c4a97d351ab8e5f2a337404d8dc2bfed7be6495947b5f92212b4953e2dd1bbc5c1bf0e651bc5c45c9e1b88d9200ee4bdaec70b73a6773012e84303e298f0ab250c91a3208966a5b54fd6c47ec623c82c7241f2fb2643a0216005670fcb68f5f6af7bf07a2912006f06366979732909fbdb2859bd2961a3c63", 0xf0}, {&(0x7f0000000680)="6e51c5ff5c6c75dffbdc285d38ec1c3abc9065a0bb7ddfaa11efe3f825ba7d51b710e4aa2dea6f8d6d0472400a09ba93436bd508c58970e7e153e4fc6c281f44c6e7ec2fb654dab5d3c5a347e2ee8c99086f05e7491e14137b8c9ae2275053e529240ff48ebe0d28bd597f90bc8222f27127f49d6c07772302aba9536efb575aed9b38c95ca60ecab3057d3e312d4c67ef82d5524b3b7d52e4f6108bcb05334d", 0xa0}], 0x3, &(0x7f0000000780)=[@dstopts_2292={{0xc0, 0x29, 0x4, {0x8, 0x14, '\x00', [@enc_lim={0x4, 0x1, 0x7}, @generic={0xfc, 0x8f, "37598eb2c64d2f6e8f29cf93d76cf59d9b5995f7066343903c9efd73465f53698da3c235cb70aa950a69b6d6e26fcf82b56d63aaa28b3384e568efa3039bde38c7a997cfb5ce4b178fb996e97c84d37653ae7b954b09d6013e52c5456cb191de662dbfae1b6a04f0b0eb0f88aab2990215b3a701942318de9c98e46364712e5e0a49e56e4bdce4f3b9206a2f77c7a9"}, @jumbo={0xc2, 0x4, 0x2}, @pad1, @enc_lim={0x4, 0x1, 0x1}, @ra={0x5, 0x2, 0xffe0}]}}}], 0xc0}}, {{&(0x7f0000000840)={0xa, 0x4e20, 0x7fff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xbc}, 0x1c, &(0x7f0000001a40)=[{&(0x7f0000000880)="28c33e483c904bb7a043f2e8f31dc4346764bf75978165bb5fcca24c1d0e9939222e90bc08209d1590cca8", 0x2b}, {&(0x7f00000008c0)="6795be9f82617a572959d3d9541c1b0ecbc205a071a3d4be98b6d68eb0f4cc4f9394a734e4bf286dab01a00831797147490cfeecf08d280fefa902a68986dd917c9e61ca4769f99ffe31357591fbcc084f41c55ee74f74ccbaac004965c0f1543b97bd00a9388746f3fe5c7db257a792d70b9ffd59a01c705a5bafc7068f4bad1921eb9d322810df9e74c3adc9995986b05e90f38e0f9da33b75846b6191c5a1e018feeb9a967855f2004ab42bfc7153da9444103bde52eef8af6277ef659ac66ac691afbe88d77dbc3c54143744e7b50fdf3a89fd4dc2289a24e19b2cf0545ba772003189c8b824729f9b9cb01a0737e4ab21971a134f4d552b5fa7af91d9b716093e0a78afd01c9b29af73f4f96bc9a88ba4b22e416ea31483d96396d73f0e7ff3b6a20d781af7c144602afcac4c263d2fcc71908bcef220b17ede395fc6d836cce250382b0a7af4e6ba8d718eb92b23ff16aba75c9f3a9e629c1bfa527260013efea91f3000c7e48a3f84d89c197f0601e4ec6f386257dacb6b521a4eb03c8add6ee28e963e1ae4a1ba023193330de3e59195333c92c6b680e492307e06bd3052e9c47874788d473e1162a3283b5c7196e74a0229500f3f6f851d2a7fabece9259e1b127a3118346460f35555925974853095a06f74e60567eeee164df88fb6a403536899e5a68cfe9510f937393ac9f24fe52442e82253e967454162864bb6f58a9474291022876fe1d7243b3e0fe3260c4a014b5a1d8db73b3add5751391f865a0704c96d8e1270a5c0fd5e3b4639a8b7f5ea490965af61885212f0c9105ba4938be6280c33ae807d202b566d5f1259fa720d404ca88f85b363a5560d20c0e19f990c22b4c994723cf13715613d2206df704cf4ee997eba18f079a4ecad14ae36c9ac97a50e587ad39ccc8c95fa4988ca5e6fb6a52ec4e64844880f24afac45b0d9fe2ddc90f8ecf6768dfc8656fef6b1d113ec40323947887623947d76f32f9691838a6f430e9bec3874d21182f78823f8bb2eea8c73e32c6682a102ac7b5f2362beb04f125bc814b7876fd3a8ee46989162053d211c1069f7a2bfd81a53c8dde97b9c98db239d9e9242b2b661e0fb06c673c71809d2e9e6d03cbe01a9d674d5cbd3d8c81659e2cb727fc50c61195a105754c7f107b3f40cd2b052b9e2b83ad940bda26d7b054afd386d1a27aebb7d3bae9f3675625f0d272db2040d846951637221de5ce8d13ff8a75c111fb5ab6493cdda7bc5c94c6dd6d2c87724e031d9a8ece867ebb0dddee4159cc5ca29dce01fc7547a8ac6bfd7590cfc9265ccc62cd9028a7a319a147e74bad3423a47afc3f058359e677bf29507f1c8005c8795fd9fd10114b325bc79cc60133c148478d81c06c9e5e14a0f79ee0787250f9b60666bb18efa48ce2d2ee55ef9b6aee6910df4579f50770593405b45358e2c04fbd80a1006da9384602d730d1fdd1b49b13a13e012cbacd74aa9bbc911ed9ea0867e161840a4df4c6d33dc3b26cf18752f060a763b47bfce7e48d0e2bf7755c3061cad78f13a6e7e0649040609ea8c83d5071ffd82a5c4c0656c8f3f9bf465dea44511b0d7b059fcd141e54c68f013f1aa769b64be7cfbea9f0c7ad6ffae4b3f3c066c98964809d739f12ed43003bd5d89e8ce9235f1cd9b116530f70566d526cd706c06ef61ae38473cf8846369f27725c19ee643d722c11fc7e11a10e062fb294e5dfc7aea67fbed2f863f062a3e7e8d746decc5f0ad31dfd46a4504ffea2832afa2c89d6ff33ac4e216ba931d2058242ac4db6834280cb575726e6d1e665b2b42e6f3847ce070f189b6e941bce52bfaada91efd470ccdcce8a396a29c540f7948cb966a820fba7336e22f9b23709628a977d2472b30522f9a9a5fdd287b93d45369c8278a591b9793005851931f43099ead107e2e5b8a8f7040a7c5e105df4bb3f19b9a1b80e85e03fed1f1515545d9ab0c8477efb92be5b712220b699ae96680416e3d869355cd6b7ff99c0c1064994c5ec0608850bdcb46c3de26e9e5759762288b34a36dd2e50f9d9e112d1590a3091e0c3d64c30d466f6aaa8871ee5bc88834c0c4a0bff400186f3e2b2f950e60bd1b38773fb3b369c4014fb62a0b6f5736605553b1a18a10c4ea070acf29c7095276f6422835b2121def124cf8e9e684fd2d4f5599cf3d8b2a2f45b0a766151e1c9a1c91ecf7d306f97a7fea9d447a289a7eab33b16cc8479848b7d3b721cde8954e957b4ccc1e34623e6955aabfd0fc945b06cc8ffa5e8015f893158c0f0da0c9aa09199f8fed5bf3d836e77e971b1b14afb4ea12b2bcb8027d6085e02bb61a5f93046647f2ca9219cc10bf90f1dbc4efc44c29563b265ec2f338f123dfc9f070f77cb6fd55119e9d4d3f70f1cf168046c54ffacf065606d04ccdc9b26cbb7db760ab31f964d33e754e3892770bbad6b5b9f6bc9661954e2bbcd29a9c6298d163edf23dc08a5f007bee6eec766fd115cc55b1808116eda5979832527388945826c89647214cb2f041bcef6ddff5f63776596558f1617def0aa1527b3f700fa823e47026785aee056d44402513a38f637b181406f8e7e5028c3881a9281cd2ee9686449ce0e24c9db1dd4db7bde0537c8a5dec046f8791014a1cd2867503e3fbc16fc33bf59cafd4f38465b27ce73b4f87bd2f85f90f817612dd19f2cca992c8c532acfbf7df7ea45c9820fddaf0a4fee6f5fd8676016601744968342f261a853cc20b785aa96bc1f922d0616db7b31c5a391e070f18eca49ef69fd29035d9b42e57447d565a95c6477712afce92b86e6f52fbc6b1e2c2d63d47408ae7bce465e33a30e575c2464c604ec73b3586c81913d22b79d01658ca7f748b7bfcda081e738cb639d03fe1336976be1b38e920f680b1fd39b5f332c28ddfcd1c837099ff568396ca1bfea7ed59b42ac3699a3898dce4a910e56c5b0774ab7070bb22034d7eb39053baac51a903dbefacb49774084fecdaf53d6bf31087b8e71ce085e9a6f280a0143a2299aef05c69cb705c88e12811c45c0a3228d90438340d18910657e9a44e1b7ccc157af191c7b73746d12c4770655d68c02716ed136cd71ea7d8394c7b714a539535c83fdd9f12f3ff23aee0428e9b72b82a80b98c385c707b587dc76352bd96fc74e07dd4dd1d6aab50ed64e241563012129743a7fdf2da84ac170273b942b97c74dca34e06d07cc381d429306387219c2109409840eb1bff773810908828cee2b4f518bee47c4a135a4fe4c28785402645b180363f7188f367d7572ce2f79d8831a711c57244273d474eb94c3f2d2bb04dd3a92c4fc625026c9b85ce216a9b446dd6f5e398e6df8c37cfa330341269a852e841352e633549f09ad1e533fb42f05b34cc7626c712d7bd60ff58d89175b812a35042d8a83b7f04acc699373db7f937951e445d48b0a8f48270fdab470362cfa2b3733befd3093468b38b0c4640b45dd8f43acb2ab7722462973880e0d1e4967fe511641415d7fbe51ea37e8438218d1d051f3fb444accae03af6e94bcd187386bd96c7a9c6fc73152010de3936afb66e3064a4d8e37f83930d00f92f441f7de8260b8235f79648bd9635a8be318c5d1a2b11f9aea2ce1cd1722e989840bb8752ebb89175b124c888a62940dde0d6ec8c2992e50e034162d62952f294d9605f6fee514f59010ca32a88e932b4f072fdad217068844ced1b806db147f280f30fed4b805e95c1e8abaa5b596a05514bdcbb5e0051664c5540704cce1fe9ef74b2e8149a93a937abd713e39622f48f1da56c577b0642437317e09070aa1da91200ac418eb4186ab3f57336015065f4540bd27ea220f087471284548e814ab233c5e591db57abafa11817e3374dbb036a9387dc4fdcd4709db823f6e20088b760fb9156392d57454b03b48489126618e2936518854efeef9829ba86866d46f95dc6a3829d3bc380bbb9d00f7e4a4dc579e8bdc6c51e75341a45280025d01a765b0d17a7636e6a29fb4ce335c4ec2e95b59b0427c9d5fb2002112c6be88071eff26e30342785c093b0596449e294ac114e3d02bdf421cb1d83e0cd5aec715351127b3d46625b8383c3262c11f6d916d434e928ac30fda9a81c38906de3dfaa2b97fd5df29e71da5ab32d979c2fc6bd71201bc3ae86dfbbe77ffa906023c34ea5ddf04e98a6412b45b00f9dafb2da456217e9f68fd97593a5a18398a36a14ba0e463d4d08ac05553977e1e36a8889c33a0d68925cb7a36a826c02176fbcc8c274150ee4c9b5f7185374497fbd2d20b782eff51ad5b382de003acd74b12fd015c8e78546d8537521072400dc4693cdadfa5736bade4dc7f335a41e5008905f1b315cf9cdcf2ad9334d2fff64cc7ea9083c03791236e717b216f4db86da1e10b947083c599bee729cf89418323c4922b720a5609e94d9ff6840164366654312d8cc8f36630e402a19626640760202aaa2e0af2ca74f4010fe519f95995aa98e1ad25b87d5e13da5afcd70a5dfb9aec0bf80182426efd7ac751cbc8a56ea8fc39f1ed0900a15fee0e0c78aa9827a92d8b4c1a28a12bf002b8e1960317d4ef7a55a3972043477ed6f367c514cdff20e6f6505ea019b4d5a1352aa79e82db28a717837edf67c2cef61db155a80e6ae92b058df1981655fcff73b8b6b55daef674bc9ca829b37a889ccec91f5ad03750295c469d4ba03e9f844fd6819a8556ac7dd7fe1c03dc79635f876954dbc0188564c6286c4e3d61cacfe4ad10553f646cc0760683895cf4c643e5dfd1aa85f0fec85299cda6e54dee9ec6235214f9eb8a98f1c15e649e23cd09c7f24f9e652e5af90d752b44cfd292cb65e33a88f419bd21d21feeec6d40abdaa39f99e83cb5d47d823cf6d60ae9eb739c5b1df9d10c7391fafb1ee49584e75983f257521d3397f3bd5ee5cd34eff37c9fd63a757046febe629c63de0d1741a83ae52408d4273280d798f239bb06474971753b4e1bac2d1b89bfd0247f43abe356d06d810855c7847e39953b1a5020cab485a10eae00971e15636d0681a0ca1fb3cec9a09058dc9adaee1b4782a111d1d728e158e516e89bca30ba621c3b0ef4e7d754afd13ddf48a188d4952997f399f7be397652cbe5118c07894a8ac8b14c452bf1b851024678489505e526a83cf423f97cb8e5a8ee0014d11212047a8540af48736fe953185578a734ba1273003c4d124424aefe344cbc1334c821c270360038e330c5bc045db59257801fdbb2270c12dd4245dea6e001f2b0bc7fb9d1154325ac911d95aeaf14055128dde314dddd85669db86174c58086424c0e28e29502c63a41d5907198dc7d8f3e42f118419d54ee8dae7ec0142dfd517f87cee09236488f8939b69829039b4212937cce634512a902efa14201866b32a5ec6a3e2ed72d204936472e126a2f8c0e2271a372f159d1d1758fc3224e620e5e8f018805499c4dbf4805fdeefc28d0d426f1ec341f9f65d78b09d4e6dc20583c57f89e015b5d5637e13be6faaf8dafafa087c825050be15f674786f314f0ceb96fbf450bbd43544cf045c23a56b21cc250a40ec51730e308b695c0f04384ab113385d287a591ee044d2452fa7528617229ec8254d3209e2295328c8a64491ba474e61fa7f6ddbd63434496f979cfa9a60a6e489738954a968c983ea0606279ff5caafcdcd02d23cbcc036a724aabcb022e90f448884d5f2e6b92c243a8bb59fc7efedbcbe1273d1b3372fc424124d35c5963328cfd54325095ad589324228fe7a77ac642659c64c64687950f506c287785dfd6de051192a08", 0x1000}, {&(0x7f00000018c0)="0becdfd99256429ee682562a608b800aacb309bb964d64af98a84da596b652187aecc4d5017d2d543047d107e3d528e4310715b628c88b34286fc5c0438785a0c5e0c8431506a978bf3cebc71a833e251d12038516a71812", 0x58}, {&(0x7f0000001940)="c3963d8d19c6b0124390d5f98e6ac6be0c43685de62792829c4a9272fda45ef1840c03245eef20e72fc4adb38c780d4e8ef34dbaac52f6a3e424cb1da43916386930c2154bbca9be1be109faef7efbbf523e994fdb747952c8c625cd739ff1451c2b9f05026958f73ecc49ec704717b8e24ea6fe087e5f03b79c82115d7dece7982e9da62fe4501d153163a8885a299e54ff6344c6c98755b6dcacc58a3d7cc3a2d37cb4d2595a2b826a07874d9944f537840f1bdd1fe4dfc409a3db5b73346a30124c8cc3ea81ca02388456881420a0e141ff38e3522e0eee0ccd6361a55ad8ff02f8f6414be53173", 0xe9}], 0x4}}, {{&(0x7f0000001a80)={0xa, 0x4e22, 0xfffeffff, @local, 0x4d}, 0x1c, &(0x7f0000001c80)=[{&(0x7f0000001ac0)="eb752e276dac8726dd44f61c7ddc54bd55b2ae983a87612337bce0b7cba82d16471cd47287b279c16f98cb72ce56ca1be137403003dd362244036bbdecfb5ee139df191bd9786f5b086e8ce6bab6de75e32522f54b638d2b4bbb9ba95413bf2b6501244e48cdbed18aef71ceac54f06f19dd956f3aa250fae136766ea54c10194b05fe7d91ca58c21bcd770c3eccdeea7ebb16ed1c11aed2071e824e4bcdf0264a808b7a938c0fb97f630923d87c160a4d6c794c0fd16f37dcf1b1345669d583a7b3f6609a6ee7051d684111b0d538b790996cac265e5846aa3c17896a257a2d8966b9328abb6ca63d687c49ec470e6daad17a398bc9c0", 0xf7}, {&(0x7f0000001bc0)}, {&(0x7f0000001c00)="9822973302adcd245be487ba8ea020621616f98e38dadebf15fa2cbc93970f976aa12abed2e002c8825868060ce5c5e9d2bee33f0fa7089bf6783a05f71e6b37af1f0d30e8e0b9f03fc8fd3cc84191dbfefee4f7e0f82bde246133f246fba6ac6ac92105b91eb0601222996eb41982d1e6965c75f8", 0x75}], 0x3, &(0x7f0000001cc0)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0xed0a}}], 0x18}}, {{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000001d00)="e748f1dfed2ff023c09bf0f43e1723a2b7a803c2f2dee2c3c9e78bfacc87b6066b17", 0x22}, {&(0x7f0000001d40)="a16d5dc2c41fb9ed704eff1984d22ce41f", 0x11}, {&(0x7f0000001d80)}], 0x3, &(0x7f0000001fc0)=ANY=[@ANYBLOB="24000000000000002900000032000000fe8000000000000000000000000000bb", @ANYRES32=0x0, @ANYBLOB="00000000000000000000290000003e0000000900000000000000f341f40750fdad450e80dd52f27b3109362c436f067f0e79b91d4ea2467390d7b158c7d3cfbff8aa8b77522f5978e6a0d7de094158c5159a061a640be4e11932138f63f3e0b6db6ebccc7a61c6788f368c3642a8235b586aff032610cf0432600bba20af9669d15fbc61caaef550ca785f26b9484d9acb1e537ea49e19f6ea5a260865d8654a3e77e862798201271ed4b4515938c13559554e6be42bfffcdd784a6afad46c682edba9ffe22689e81d5774f893ff1e6a36e259eddd1f1f7d29d35833fd1a26030c307fc49c7aa85d6f1fee7d1f69f8421cbd004ac17182ef8406948de4216b87fcf19506c3cfb9931ea7561e3649714dabc84d3ed4ec7109ffe15d06b62204ccc85ccbab4318c6b195b0bfd07fbffe7283ddf5cbb851c1fd51fd689942069be95bc0cdbb05dc1f9997377878285de37edb17cb39439b72b29fbfb5c14b276017854636a0dcf302f5f0bec0fd14ca98c1e748ef6e1e3dae03da4446e970bce52dd3cbd662d08c84cd262d4a15"], 0x40}}], 0x5, 0x4000) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) fchdir(r3) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x2, @any, 0x6, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfd, @none, 0xff8a, 0x2}, 0xe) 18:12:32 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x1a8, 0x4440) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:12:32 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x40, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x5}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x3, @none, 0x3}, 0xe) r1 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) close(r1) 18:12:32 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:12:32 executing program 1: syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) syz_io_uring_setup(0x3c11, &(0x7f0000000040)={0x0, 0x8595, 0x0, 0x1, 0x27a, 0x0, r0}, &(0x7f0000001000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0xe628, 0x1}, 0xe) 18:12:32 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:32 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x2) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000840)={0x0, 0x0, 0x85, 0x7f, @scatter={0x7, 0x0, &(0x7f0000000680)=[{&(0x7f0000000380)=""/34, 0x22}, {&(0x7f00000003c0)=""/85, 0x55}, {&(0x7f0000000440)=""/24, 0x18}, {&(0x7f0000000480)=""/180, 0xb4}, {&(0x7f0000001040)=""/4096, 0x1000}, {&(0x7f0000000540)=""/182, 0xb6}, {&(0x7f0000000600)=""/93, 0x5d}]}, &(0x7f0000000700)="795257a74c1626a04345282fc6f5e3d062e67d43a21f34cdf71bb3635c9c01d425e622b277a49bd13d414c6cd3fcb9d0ce338d36ba2f496c2dbd716e3fa76662796a1b47608db4af49bd6cf8dcfff42b9d0f5628ec22697d4348b2808c9610e0a787487e6498094ae05156fa99cccb152523b0bec3b466d0ca091c8524075b7d9e317ce984", &(0x7f00000007c0)=""/60, 0x0, 0x2, 0x0, &(0x7f0000000800)}) r2 = syz_io_uring_setup(0x3575, &(0x7f0000000000)={0x0, 0x3280, 0x4, 0x2, 0x356}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000100)={"55527431c61bdb6ce512e812fa46cde0", 0x0, 0x0, {0x7fff, 0x6}, {0x3, 0x2}, 0x80000001, [0x6, 0x40, 0x7ff, 0x400, 0x6, 0x1, 0x0, 0x8, 0x9, 0x2, 0x972, 0x4, 0xdd, 0x1ff, 0x8, 0x7]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000000280)={"8d52a9e26cc5afb6bd38253bf1dc3d99", r3, 0x0, {0x3, 0x6}, {0x9, 0x6}, 0x1, [0x1, 0x1, 0x6, 0x3, 0x8, 0x4, 0x6, 0x8001, 0x7, 0x2, 0x200, 0x1, 0x1, 0x5, 0x3, 0x400000000]}) fcntl$setsig(0xffffffffffffffff, 0xa, 0x2c) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r4 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r4}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) preadv(r4, &(0x7f0000000900)=[{&(0x7f00000008c0)=""/40, 0x28}, {&(0x7f0000002040)=""/4096, 0x1000}], 0x2, 0xf41, 0xda19) 18:12:32 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setpriority(0x0, 0x0, 0x0) r0 = gettid() setpriority(0x1, r0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x7, 0x40, 0xa9, 0x4, 0x0, 0x40061e8e, 0x8000, 0xd, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x3, 0x4, @perf_config_ext={0x9, 0x3}, 0x41610, 0x7, 0x9, 0x9, 0x1, 0x2, 0x100, 0x0, 0x3, 0x0, 0x5}, r0, 0xa, 0xffffffffffffffff, 0xa) 18:12:32 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:12:32 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:12:32 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) r1 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x2b5}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000640), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) ioctl$BTRFS_IOC_BALANCE_CTL(r1, 0x40049421, 0x2) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000680)={0x8001, 0x1, 0xfffd, 0xe0, 0x40, 0x0, 0x3}, 0xc) bind$bt_l2cap(r0, &(0x7f0000000400)={0x1f, 0x5, @none, 0x7f9a, 0x1}, 0xe) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r2, 0xd000943e, &(0x7f00000006c0)={0x0, 0x0, "9b329b9804f18349f94bba11dbc45b86bf02f8504df8cdcb4040389743f641ca7e7b1f46750b410226f1df2f431948c41ee0d3dd929f877234b105f8d768973e515266c52affc86cc8e933203dc1425268d680596b01750398011e7ddf2cedc14c1bea048a83d2dab46bfe83757809c98d4a372d3e08434807b8ce69035d122cd8178781a42c2073e352753bdc344c581b2c3543e1dfd67f778ea64b2762e55e157ea300b6c56f351850dffe374cbb6b60c92b889d9019ccef8cf781b90c7d554d2847bdfa8dbe5322e4f920f70de73051b9890d1f8acc8558adf0bcaf4870bf1a8504da3e3a3664c29ebd38ddf578f6cdb778aeff13dd44453e1c891c707367", "bd2b3b7e89d441f76b5e7d3c95dc4fbe3d076acc8f6e83d080b1492c2ddac793bd4cf086e975ea5df4909a25fe2f7e189bbf7a030fc89878561e8f8befe4960ce6c6649aa0ada158410e3a98815ffc242a4fbbefdf2f3a258d009841b3778697c1623dab9d102a83bec457c5a181941e2d6890f68645b3041f74334e0a015731e87f7b4bfa7cb1d1ffa28bb207ff7eb704f6660468072197a51760e5f9201b8161ca1a554fa0513bb52a6c85b8e7e41b64b5984228d733e84af07c8424e431976f6f70867c68d0a0b8ca440cff210332ecb1bc942fdb13a24bf5f96da439411ab857efbc3fb57c3407b5ab3f28d314d9a05f510528518cac7a48f1785db79a3a8fd40cfcdef78a15cd945ed9b68468e93b2093d520676a99d5f8bc352085d597a41576ca7db7f2e0c52fd573532a3dbb5e471206006c1a016c8ed0789c155a1326d30bfaa94d83d00f19f9ef33fec43d6c1413af5c37bcc06e8d91ea33b3fb95291cd304e92bea4b00525c1e01b670d7e4ba2f09ebde48c2c7b40522441ca1da9439a9931d7825e34838bcf76dead434c38706ed7fab82a9a9683ac903596644e104bfd3cc523a42d4675ab34ed0a074ec62401ded51bfcf1be1182dd2d3d2e9a5e78772f694d5b75dc3f945116e1c5ed577b2b88d353739a315dd70e417a985d718d22f7782504f7e80425189d06f85fb972e6f34ce5bc75b6a9b0a55a776158f66cf861d79308be3c6045dd926e322d720eed9ec6bef0ccfd911b327decc25e3c8dfe7f804618a90e2dfed87d90fe2b62ee1fc232aa7ae900d9f958dd92e18fa987e77c99f2952de6106c645538d081239b04f40e86a0dec7f8c61f4b14a8268a8929d839e2e281febc927c78272399c94e863736cfb6afd4a7e8af8c8492e24d540197ed63c3d5361da0452c2353c9a0e3cb85cb5f17c02d7c4abdb04f6bbfb2822a69b2104c3b7e300bc29007e90939cf49f020778c8436ca90e2bd56761d62a0ede2d18d57d9373a7b9af66f2ff5136de0eb7aa98f52b90120447699f04dd51c3ad353f0636dc2fc7e47063cead7c3d1c3b369919f666de663c71a452d04f15ec7d0f850a10f2c8f053f139c2dbca27a8f75e51617b7b5f4b28420abd529248a66b42bc0ba8d614e610d52b11b8d79f5d0fc20ca6ac8089508326c9f4c73aa6eb21b19f5eaf643b4dc868a1b2ce784b9da6c8554ba39bcfda637de08e1ddd1e368e47cbfe37a14b5943e55d9a86a2fc7eb205ed370320db21eaad9c1a164e125f651a664dc09ad3bdd2b43683a87536dc418599d7a8cb23da761aadd55b0fa509e606e0850095fbc6f7aaa04163d00fd77ede57e1725049cd346f2595a7ac66a1ddcaec53791a9f8baac49bac4c1b0633f9bc76db9c329996ebd650418638fbc9fb87dd8de12de88880ee1b9e638ce43e4259b7e8b09e16f9cb3ed6a7b0b23b10e98d71dced5ec191b40d11193e338f32dacfce5425f20af5c227c32368c251999f8b3408be3e75a55d975e6893ca440134a079f6afbdb485cb277eb0e8d1aaced491135b242dc2dbd954964ef05f68151fef0c67ba1aff46a36fdeb7423447d1bb1ff8e02e6a9f2db48a6103663dcbf822f936d7cd11b2fe8121b2827e4e81e377b66677c8e600c9a8c4bc7ed145300e828fc214ddce3a684bace24e7d41f4ada5e0aeebb50ad1e91fcaa8b6e795bff54ace70ed7280225dbba9f522aa0c62ac5a1d0d7f005e1a7094b7e25e323c94c9154ac55750c3992984730ec9d0215c20b2cff9b32efe0d9ee8ae0b8ddc9575b426b1785990b8f1946484e5d7998baf8bd9645e7ba0939fd222cbbc673b4da6db13f0063a1f5a07cfbd897472f069416d60f2a44ce89899c4a52919c3759ea15f514a2429344f5179ecc6376346e48ef23673a7b0d2de8598f52ff62c2d25ede5056eaa0ac20393ff4c7ea6669d054be624a5fa1d59820a5237dd32b98169dd3f2f0c81745c8eb5c86fbf48b495aee4363adf05dfaee1f8c3d4ac326a5a1eab90a6835d13f7523683ef71b884b9773051c022ee7179191c02d0ed5eb1c7c8df9b75fb2b528785e53567ff59c59306cb4e3c15cca78ebdd9654318437bc5a68b14b2475410a0dc80041d31d1f9ad459bfae47b9786f123816cddbaf7b73f07fd9da64ba6a27f51d883b89683679c829e5bba063678ee8b7fe93e04c549a7a9622e693145d1cce961d34248616414a2ef84a6ff437f55bee6b2945836c18ef79d3a2ad6cd407e822f859af56a9ffc70689de72ed705561dd7d16808649af02a23d04cee5b574fe9d750d7ccd6a7de6936d773774b97688395480c5e97e5992d3825b5f3f91f106478cd79fb009a7cd3037ccb631540b3d134125fce27db7ed9af18d7b4d5b49c6267c3eb525d1a3b04ed8021bade8141ba2d10d885c0a8e4218d4f41cc89a88c7860bf71afa4a1e60f9a9abb6edb5abc26b29ac0c802bf035fffed4873ed99b941bc5a86f59bc1c9478a02cb18be1df7a0a628c9daafa23ede541e8aa69075552c8ccd18c00975f834b4a37d54375cad513bf84e604c6bfc5c77e8292af3a9f811e93b9234276f560956bc4b76b14630e659f58a25a794a0a96b05cf6c579443eee86a26a22206e2ea174f0a2389fc3f8b201833a683473471248f4e5f8867be48b13c554de0fe269fb6fd35aa6afcebefbcfa1c933412f485444ac879b16af2705252d281d1884fdb9b9818593fe2b8aa281df692be75391e3355c6f08c4a8f044a21d997316ec00dcce68b7f65a89322fb5df2e27e8a4029eaf2efccc4a085d5b97a8e7eec5dae2f07b2f43beae32a96cb979ca369260bc34ec9a73ce338e972ef2259087c976de7963acc4e529c7bb1059007b95ff6e075d73085282cb66f2e24959a815f691a6f2f14407818098f712e5cba7771d03ed8cf2a9ea9a7bee19286a2f7a726e072c8abb4fef6d28266d2762c53d6afec16e11e0804a0875123b0eb76265c1e55d93ca3508067f249b8c55ac6251d59620de088bd9bb1c6084d170fd9aeb70d1fc9d3cdde9585d777f33e32f0401b9787a788cd1f2e7b7c36e54cc3ff437ef848b4e40aea4a0cf90729d823e7ab08425f7fec16c66ee699be65e72fc3126132bbe5a2bb1a849ef6e36767d6b2293d322199e3de19d5e7d7b5916b72d229c9895cf377015e6a3a632d231a1dc6d92664868be755bda5ee5bfa48a26445929d3ee6f90f3f1a2cbd7c96091d854ff081e4fb711d006eeea203efffe274f0e264d49bfacdf6f9eb63a96d709d3efc1b5a2a438aa7bf71e1ca21a482ef31a00c5f1858dfd8728a997a0464e5942c476bfa66293f71b5f428ec8f8bc3222dfd21ef987933a0e3e920c2bd7ef1c9d9b450d6ff5d332d5b2ef611dc4875449273862e925296c2840612d30d7359880f5d39fb220a7c41bcf709882ecf88dc79c424678bed91fd451896dfc1ac1d3f424d25ea1298f120e9d956a1a03df511424989cd0f254a963c21eaf8e2d84985ff626995a8672c0a3109790c06b42b19a32c00093b58c04fe013c440e3c2a44e668f665edb7ee238c1c9d81ca5569e766cef47aaaeb36126806e16e5d114a470c05ad8511278042c64060bb9070c9a533e5ee621efa4083e038bed544a9611fa3f67d360ef15c4e5c0e5c5af042e422a17cd7b08b8d972925ab3adcbad4c3b4d87ce447585231b2ea21ac67cb2edd6d4b68650e892d311d6ab82427b890b3dc9b334b680e578ef0bd168124d782cad155f7336b03f19cc63429ba60f1a6cbaa3a04deaf8ffd12a65ed22afb991ef05e02b070460db95d228f5bbeddc0b94a2fe09cc9bd454a1ceb00549b91d31e55c09b669aa4340ecd595706a4049ea580250d76867e32f1d06d254d8d2b00130f0585eae1977b5713afae9c68e5083faf25e0ae4479791e3e08e6e0f8e4076c90f674da90d5ea68f62ec230bd5d123ce2ec15d17f88a0a2e9f78ecef55b0a336fbd334d2bb0a0cf81abf46e8a4019c6f747106689b18438888e657d973c409dc0284cd69305cbde38cc6432a2029dd284960f0f1f4df8e43c0c84f00a208c5f5ef9f931a6b825b7e325b49cfd74312bb0b5b23a60734e404f011449a25456a88eeb2b995998a1ce045e505bcccbbbae9caeb127bce61f3cac18bd42365c8b39d5cec43adac0350dfa99def869db41e7783322897026b8a1b06881c1da77d68ceb7cffb2abb334e8842b29a260b769c22af36bd0740a9a1731a30c3677b1d915f9c95c45e97fa36c5df8ad966abe0235bb800b698a93c8132b2f7f1f34fbc200cd76b222e4cd28423e126a705ef50ed940851b5729420f798b04cc57aad760e19e0710be7e507af55c4dc99d7e73789ecbcfb369d68647239024cc9c0f5aab6c888189d0672d77104d869fa1b195787ae2b681333c80cdb9f1b4e8f1c46c57f7b9fb650389ba293f06a403766e5731c6a66affa6b6c7efa60ab97625488df50ad0f49b90ac8f6d9ed42f49d32ef70dc7c832e198cf6889fe1c505cbcb6cd0eafc13e2b88d83873a665d1c3f81ee1314efebe3ba872331276c0e4bb7b6034fa1f44b39b8787f943e9bf1b20b5f983189a5976b03b2aba1ab3d93141bac7384a349380fa9f4b780c36ed65ccc6a7696894c033de2ae5796cb602bcdac89203dcf293ce407bbf985d1545aa8b2dfcf5a51c20ae038be03a07453d3e66f602320354a9dbeba5fb6d40ccc2d20b606c397ce1169b8d973cb1424b52719b46b87e96879451aaa50151ed6ad33ec13571179a5a92692fce49e03bb52924778885c90219616791121916e9c3d8b3e5a64ed6a94ae3dfcce48c2a6d1336857308c1688aa183e9b82b6767877151ff27f0656254ec41e16b255230b7f61d49acd11f7f94cde0050984ae9b36b2ca70930ebf449f9345d03d3ac6d11cbfb2eac1ce28ab409038e7efd260a7eb05ac8581a8ff9160bac506fe0c0ad64982fad354d30a403b9775751009c3cc781f12398d1e8682e6d6d354b8a7855aa4a84faaa7f32322a33e53847eb8fb2a77675fe1a534a3d3fb4535c647b092683a0d8dc77c65a5c37290991060af4f15128b7066e0d7bd6bf43e5805bc5fb09574726fdf087322355f76ba62e16706d01da033f0180604cab442179fcb3538c965189a425df621432857c1549c149b723279c78394c68d8492429e8cceca54289074c8a51b907dbfc83742049e4b34f71fb960f012e18c49f7566147439eb1ae8b27961e8b275b10cedd7dcbc1c242c940f57cbceb5e7687ea7774614846056c453877a362577b074c598eaad3b6e4f0002363b65130156a71f70b388e969a505de5bf12aada36e49c31bf60979a9b68651db244b673ca0817f3ca570def725dca846f6ee633db9532b804feed80eff8f10a7a0392c6e4547191ec9f2cf0ec1d91485c1"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000440)) sendmsg$sock(r3, &(0x7f00000003c0)={&(0x7f0000000040)=@sco={0x1f, @none}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000140)="e14a9be7a731e1657603d74d6e5b698c0ac2a4043fd51855a49e84fea59f3bf2fbeb66c98690c5c7cdfe4d9c2201758438e5559bec39e4125005bcf52225506785eff2c6487bcbb49f164e0a994d5caec1b3bfafeb4d8359f61408d5c9dfe3e638f7ae09ef68c4e60e017513b27875a8e28a33b900709d9190053374c1a9c52d41918919457f20b7e5b5290e06897fca04cc341bd94701a956cf34425660da7a2e43f3b8940b15a013eaac7be73fac310026d4f68aeafc5cc4cac1aff03f1ded3198e5146b613634e77b4837a14bede1bbb021fdac7bb8969afbe7a3bfcc14c382ed8cb94a3038", 0xe7}, {&(0x7f0000000240)="ef97fd07ca614c57da7675b4b019395cfa4631e4b2bc788f07747dab8e8c7427c749d65e19552c3b031aa48f5231d452ebe3e7257d248e4be8f3431c334224f764c429b697a00d8404e98df5f65d5964305457537c5956", 0x57}, {&(0x7f00000000c0)="13aec585598299c126", 0x9}], 0x3, &(0x7f0000000300)=[@txtime={{0x18, 0x1, 0x3d, 0xff}}, @timestamping={{0x14, 0x1, 0x25, 0x4204}}, @mark={{0x14, 0x1, 0x24, 0x200}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}, @mark={{0x14, 0x1, 0x24, 0x5}}, @txtime={{0x18, 0x1, 0x3d, 0x9}}, @txtime={{0x18, 0x1, 0x3d, 0x8}}, @timestamping={{0x14, 0x1, 0x25, 0x2}}], 0xc0}, 0x8000) 18:12:50 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:50 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:50 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000)={0x0, 0x2, 0x7, 0x40, 0x27, 0x8, 0xffff}, 0xc) 18:12:50 executing program 5: r0 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r0}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000480)) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x400201, 0x0) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="2052fe5882dd8b122d723c156f66b37ca5de857e7fa3b17fb65c419a4005df97a3ed38bafdc1457b072ae8ce8ae7eeac0111ccbe5f12db6a0a1a44cca37167918a9649b6398622ad78d621165beaf5ebffd59cffa2577f2b5988332b7e892f3ba5a999fa2d591fd7ed91e22f96714826f18dea00d52eb3b8cde468a2f4c028624ec95eaf0921474e62bc84", 0x8b}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="3c00000000000000000000000f0000000088053a27c64424fa91ac14143800000004ffffffff0000094eac1414bb000001007f000001000000010000000000003000000000000000000000000700000044207b60000000070000000600000100000000b30000000200000004000001ff110000000000000000000000010000000200000000000000110000000000000000000000010000008000000000000000d40000000000000000000000070000000094040000430decda485b48d54a452070209404000001862100000003020fb48673cff1916a125c8aefe36402020206773ab5860004fdfb8612fffffffb020cc5f63ce4f09d49002796867000000003050b5a44f725f1503fd9d8000dd4835601b94081f2b9839a050bcdc9a137b7d943ff780103060202040e82dc3b5099719432931a475900113c59b8728fec160ebf697f594cca7206081ba9984d8f010212b7192409351a0ff95e148c932bc141020509dc51f1400e57888908731eb0ecdaf7000000000000"], 0x178}, 0x48080) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0), 0x0, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @remote, @broadcast}}}], 0x20}, 0x0) sendmsg$inet(r2, &(0x7f0000000200)={&(0x7f0000000180)={0x2, 0x4e20, @local}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000001040)="605c128c5edc96ca33c2af3b90b32333278e229f7351be159c3fb464ce1282336e704ab214659690a54803370ecf9ea824e67aabfc749b34392018152116616cfc2b8bfa1f61aa6f689f2d133d2d12ea75d2b1bcbb4a72362f4edc4c75d368bb4506e5865756334e83ad3ba526d63f7827abe2cb8b2095eb90eac5cbf5a215af3cbb1431f16b72fae4df5365f1f68cb975690cff0a5ea7b0092a26c8b146b4b2bb4a887c7235c58eb59b42293421476c709a7124cc10750d84162569946c2767e26a3956e15b7bfcf5d66460096aae17c2b6f83fe4be473fbb79f9c1243cb5c95c87a66869e849efb4aa404242f0b0683391613d8b486a18a8268d91e99bc460f1a6dbc9e530b3ed63a29921d036d28db0d797c8124c7cc7135d3a8d398bc85d47eda95dbdbccf8d9d56bd9f726a83fbf5171bff327cfdd27c496660f3ccc67144a292bb759d6372fa305dfc06bf5f6294929e68bb4d96c9c6240487ad3d292283e50a5dd238ec84917345013dc6124193aff4598efdfba62307033d5f67573132aa46089e62aaace25fbe7970dd61b5424969ff6abfe5833a0642243db5a4a2b1f836d6a1411580f308a31918d5af3404355031bdf20a00842885c50c43c42d50d1b19fbb74acf8e9bf67beda289eba8229c3237fe2956bba8812bd197bf99a2ed07661bf3d0a11b2ec861040889666e50620f4f86b836241a5f98e0ef909d47269ac7136ea5df7abd3e8ce9388ba0710f25acca63722f4fbbb2a3324fabf5ec409034e2277c09b77ff38312292c877d860935c3cc93e075ae756b690aaeec3ff9faf73b6c3b1546e7cc8f0c8c9ce89e85187cf86d687098246494659cd7dbfbea71ffc455117c98c7560943bd17150b0a5847daf904d89c445d81414c0f981b2dd6208bf258ea1ee263e120dfd0f7b17ac56427d3996e3cdfa75e08fd24a5de1cd438961152e4e23671a8052509f1a7562b5f220137844cfcf5418ec8090f53be9bca887f0418dadbfceab9b4bbbebd8329c3dc0505f3de3af8a5c61efd8da76965bb58ff2dd7a4a0ded04b3a5356e033ad080bf66ee133cd8b43757f53a51b06e82932abdfa39fe83ce2eb056667a6ee38d7981acf7e10ed03c7c3abaf09c7149493c27213417ca601b339ed2118114bc48e70c6ab67c1470c15d6dd75c25fe7ec9fd4585b9f3b29a2a98a64113225560dc3abc21db597afc0db18c8d2abf2fc41a6d0039c4ebab1b671a7d2c5b2e97556f3149c2182b27c6029a20032eb93e5903423a7e1eebe082e44a7e98bcef98cedd9484bdf80bea558632ded36e541daa67ccdfe1ac90132bf67b9fef34dff07f36ffd6f7dff47327eec8bd7b7223ff7fbf872a0d9809b815d192defec223a42f434ba683976495b0fd2d13f37cee961f3b3a9f6afd429ca128fa3ac2a51a24e096c674747517818d322bb95847e6673a1071c2d5e7e21bdff1cc0c062a3f8701a0408634be7e628348da717483b74b208349ed2ea4e0a1758f17a4d97573c6356dc81fbd8deea0dc1d34af986c3f528b1d0725167c69689a8102e5033d422b1f73c169c9e8fa98ab293892b015858b01d212241a18862c62caa13a46953ab18a90c0a4222ebfa6d64f8b143c8a20379ba492a9095d902a60f7242ce87a0719d2b63f0b788679d3363875f46c5bbb8e4742945736116687b2454ffcac5d57a5a57aeea367ea2ed75d7250491caff3870f7c7b50eec16b6ad4bc29992fcc22c884fd6f1778965c4f9029e553d87f7401063702703425858ad4c20a2b226e949aec61b874364dcb3c1181b7cc852087e76769f8dba3c3987e9b0d847b5973bc481c2c31843b1ab7b170f8dd4d9cfb662843a92731c7c26b3e302fe4262d605ce9e85e439a4d6b878f2bd2f0077cb4ec0922eafcbafc37d8fb8de0d1d9e407707a220bdd6e142ab8411dd1d8f72055eeb0aeb39d7f6303e67e67dad98ff92a8469197a54bf1cfc265769de055c2be30684fac6b8e2d839f81fc20aee5d26be9fdc8083b0fc60857201ecbd64fb890e7986e2d0fcc5c56c3813fecfdfb7088eb01c6b82feb5338f8b629564d1dc266b8c1bc0127a276752964a3e77ef7da54b4749f641c53d6919e9316d6edd2cc8e80a7cccc737ee366477de34dba87d10c71842df9bbcc0683f10da1006a1de99778c3f02b9419921c761f6338d20a6016411061e673fefba9736c06d63cb00ed7c733c08a3573e1c45d3cd8303d7dc0fc0a0956b8e4fabc82b571c3b5e42d7a21bf67b2423fdae978f0828b8260cb3ac97d8cca0e85f712f13b8652db99a2a21cb6eaa8b93ceb356f6469833e9dedf225fdcef50ee39d13de16569c7414b4d12b076a5ec62688263fd9d9ce68083ded19eaa3cf1c3e5766fc6d9d53df7b986ca66112afa88a8c778c9ee0c82eea36839cb3999f9a439c6aebf04e43d376290cd8d1ab2ee7da618cebabcee2d369f1871601d16ac81b79d5626f96c9ac98c2c08c583e2ed89ebcf9bfa444928929bc6a7cf02dd330bd3b074af37ad17aacf15d9cc56608473f2f2d1cfc7c32060024d3bf11c32b9f05ca984509ebe6983d63d56f4eb218399b82eb125020a7c96fcfacc1045f73977bbd0d5799563f66857af5c84c1a7cd6efe84d04db52bdf4689654637b5e3dddd9834fc63cc19aa6ff392d4337f403598c30235c8925372b234f39dde138bd7bc1809cd0da8b69011377adb8888209878200093a9209698ab6878ad6e9a5e0330fcb5eeea8dc96ed7870093bea8cc26ee7de1ad48c167b60ed19e8e3be13436d7f7bdf2310b0bde5ae6c3bd277ce84c96239cc9943e6bbe16c65bbb51f6332d423cc215f51126cc3392cafb78e418dd64638fd64f46bb768827b3eba7a103659e854b540dfc30068d8d24d42155e5ad2fd1981dadc3357df762d7a389e8c1e2832826825d325c27f13c28b9c80cdd453418c3fb1a9adc3658017b899d3de26248d722489a576f7859c3c4e3d68c11bf7165f2344c58ca3e9fe6677774c6a042892e67c3e028c631802523dcd276b79c1e77b9fb5d5affa6cb16f5f6e53a9da775887e9a6b8800b63db2226f101b1c2f2ffb354ea0da2bba68ed463b7b1ef4aee824e82bebc55cf5da830a93a4e9be8101df9445f61345f07b8b34976b8a48b48560adf566adef215039f369fde66cc8048a4db338c93ef4bd3a08239a17cdd78568617e2ffe05ad0a63d80c31f6e39595c5a0bfb291f8a650126469a6b5d6dbc2dbd355b02484b2300ff219fcd29b8c0e65fe14421a7f1ea9f6c7ef0dba4f89e6f57f582192006cdf872f65be3cd73e899cf7e03f4b5f92c70aae89d7dfb85efcd16eeaf48635a6c38409400c7f2a6b4d17731c8ce37f0113206b94e6b4c01c9222daa16cfa6f750eb4c033cdd54b14357c00368aa3482634ce6014f9052fa7f8c7fb09991cc3837d096de9e206bd365fa439a49c750596b3387e33b4085594eaffd1aee404d19411184acafd22eb62ad6cf536e116a5a27e40c9424987c69c1935dbf81110beb5e30d5f6716acc0e17887957688ba20a15643d6d17d88be29e00e585b5bef5a4f2c371591abbab046f785fc0a9ec597b115821147a68ffa14914bb38b4c7b00d02e50a5221172dcc559a4891c1718da9284ce9d2dfa30087383cb582f1f4df9da056db4ef6cf606e5ad83be13968d5116323b42805cf1691a7b4cb1ecf1651893259206276eefbc1dc28ba8bd30b0fdbdce7670b0e210e5c9f1996c8018bcea0c8f38f48ce9cb61efee2a3f8765a27767d7e658491c8eb7cf3c5bfe5d68e7cb3a635d882821d64a64c0bbc316a376531c84f9920a27c469060e81ecd3fb0cee5f5a781c55c0c6c7c6fadc341d06ae43717b798fbf919d6574911430d55ea84825c8a21c9cb80124e514d230395210b689ccd80445a2b3533669f62100ff88715e5478b3e7ec99b7ed25155df83687a9c23d727390af9f69996adfb1e7cffaba71342016b5306511fbf32690aa9f926b7c5b62e711ad5a2761250799efca07392bcb77389b1367f80dfdd07f90f95e42b6140d904e0639cd8b4e0e01ee129c3b5b7a0b4774774087fedf1c0c647eea0c68a58afbacdc44cb7ef896e158e2b5632dcdc1906c827e9df32ff0adaf9a98db930257270147385548e56d83611a650e56ef064c1685f3cd416c343b3ea9c879934512e75f08d93546352ea6b89cd91d16a18d3a9f895130b71e819e79b77a0d027fc50c030980e359e9d47ea018762352253bac5c94ddb19af0924bbb79a7ce7cf428b715a1e8a91cad0fdbca561693349239c2e64c5feab2daa29abe76041f2497d2ac68ef412da2edf6c341fd081bbbdb873d70b39a0217055f1593fd749d39b2fd62603cf7012a30cf1ea1ba5d474f89bbcafebd6e3b9fe9ba7d22aaeaa98f6fa248b524d291d91b562cdb8054ad6fee299f3c09b77fc4114a18a0b3a94d51de8b52ed047254184993a758df7eba3ab94aac0d1eb809252281b2f870bc47e7fc6bee8b9d8af120bf871fcdfd9472e001b74694f74d1e03cba48119ef6b7c41923187a808ef0e498d1d202da3c25b9f254b39554fc4f7f8d2ddecd6689996ec8d113d1cb06f1b21508b02b736a1879d3a7352f6ce6a6fd184285ce3428fddfa397d85c9eb4caceef5eff0b3a245e232da7c51d8ecec4c69d870257f41aa32172d2543e9abb566f934c77695ca6563799cb4276c2eb708277e2114caef407997346a46cf0e190f942b3635743b469a65dbce991b6160dd16fd610970b270e713288e006cb210a4a4950bbb7caa1b49fd082289354fdbbfb6ee794f62622917eae161ba4edb7250eaa4c332e89b6e1b8172f4418353156d483eda3d46eb4bfa169da15c5a68451a2f2cbc717cffaae7135e350602f29698eff13e18192b404a86ee91054dcdc5d96d11cd9293b62bc6f74dd9a6ffe88feded6599829e17b02b002921f7169a1a42ef8eb335ce8bcbc764ad1d7ec09a4d624a11fe3a9d4f11348af46175992e24b3543e078a764851e6cc0085940bbdb88d1822312d997b1cd92744c1db59b1223281977e28c2585ec0d4a567c5cd3bdc6d857bd2402d10d867e33fa8b731ec1110f1fcfdc12c4013939ed2e0c7daacc0b3002676f1af1c0ac28e8e92e43b030a7d8a26d82c5f8746a57a4dea754ccc9dc37f4730ca3281ca40e1cfb48b78767d7eadacb2ba4c6a7ee4f2711fd16ee9de895649ba57305d38a7cd7fd5557e7b55409e175c7cf7a3329b84d2689f19c8a3e504eaaadf1b67a93957b6a7eb2ad4836fb3451d19986dd9af38af8ecd0e044d89ebb82a6d453c037ca583a0c7aa713da837800cf2611dd2ebe44bd62f16cfa33f657141aba68ad3b3c4cf9ca81b4b8b6d21d131cc3831c1f236413bf66de74d277ef9c02179e2c59378fe882e9cfacb011a36435ed15cd6bbfe727e162a1ea91a055f8455915cef4a4ee5e283753c56febe107d8976ce9776a156929e869c5ce3951a58e004bc1e0dcc1c57aab22659aea9ef162a93f4fe3c9d0ae06bd127507456fb4b586d0aba5dd29f90d420023397f847bdc69497e544dc95f721b9307fa5fdcec07caa8de315185cb8eedf87f972b58c7e2e9376f89e839b19f0b6df586b3d0020cd2e688b46c312d2d4522a6d487b10a5268936b1a642793fdd3a06943a5e2c947f7cc284c491996adda98154372dafea1309b35885ef9ac4231ac0de85e611be53ddad18e98886a730975cead36c22e2beab5172e712f9d69e9bb1e37b5e60e94bf8787b47e1c74788c332c0ba394c8b54d7a4a8bce052a587172be7", 0x1000}], 0x1, &(0x7f0000000400)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x80000000}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @loopback, @local}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1}}], 0x68}, 0x40) 18:12:50 executing program 1: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f0000000240)=ANY=[@ANYBLOB="0100000001000000a0ffffffaeffc90a3aefdfbe8905ca4e28d44546aee611c85a5adb682a0a59ee0af2691c45b7fe38790d477996884200c82cebf155d863768d8f291f6d2938e47ddf209c2b32d10f84fbf5c91375b8d2852ea9f77aeb9ac3c3f38f3b9ceb8c11d5c73ec192442bc8e27016d208aa7b9104829c34e500027c4dfa4c281ae0d66245570e76f5f765bf0dcf2922f0a847cac2acbb3c772223638a84f0c07ef3b94f13b83fd6377c7d6d34d4f0e2398478f653ab236a36aaf0b4f93f886431d236b26fe7231333ab", @ANYRES32=r1, @ANYBLOB="00000100000000002e2f66696c653000"]) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000040)={0x2e, 0x2}, 0x2) ioctl$BTRFS_IOC_INO_PATHS(r2, 0xc0389423, &(0x7f00000000c0)={0x2074, 0x8, [0x7ff, 0xfffffffffffffffc, 0x7fffffff, 0x826c], &(0x7f0000000080)=[0x0]}) bind$bt_l2cap(r2, &(0x7f0000000100)={0x1f, 0x421, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1, 0x4}, 0xe) 18:12:50 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x5, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, @in_args={0x1}}, './file0\x00'}) r2 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) 18:12:50 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:12:50 executing program 2: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000080)={0x200017e}) close(r0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000400)={0x0, 0x0}) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x800) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8001}, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000600)={0x4, 0x80, 0x6, 0x1f, 0x1, 0x40, 0x0, 0x5, 0xb0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8, 0x22bae3175adc42dd, @perf_bp={&(0x7f0000000200), 0xe}, 0x1000, 0x82, 0x0, 0x2, 0x100000000, 0x8, 0x38, 0x0, 0x6, 0x0, 0x1000}, r1, 0x7, r0, 0x13) io_setup(0x9, &(0x7f0000000140)=0x0) r3 = openat$sr(0xffffffffffffff9c, &(0x7f0000000380), 0x800, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x100000000) io_submit(r2, 0x1, &(0x7f00000005c0)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f00000001c0)=')', 0x1}]) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r4) sendmsg$IEEE802154_ASSOCIATE_REQ(r4, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001440)={&(0x7f0000000680)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000000100004006000a008000000006000800000000000500070000000000988928a4cc9c448f8eb3d92210672727f7fd6de08ef80206895122d5837184cc31d2d598cb4d46f2d9706aba7c47e3d1995ff5e7e395e4faad97b97bbd7cca069ee4a4645c478cb2cfd9c0b3bea70db326c0fb0468e26e22b24301990b699df8444af8c9dde2c6a8c9d23bde928319a291501bfeabf6b2c90e41bb289647e33c0c893a5034bfa8d841d262ad6bc427e04a236bca232446cd37c718e5c1ec2133588bfeb936c52b4c3e589cf8bfe148f01aa23d1230c103d12c7bbf9029bdf42646c573ab1c67678afd5259db88ef29378b93cfad4f5d6c335fdc9f501983325918ca7b901363d66cf04f7e23b9cabdc6265940134d80603ca7490282bffd9ac25293f46ec1aac0c038f0d335296094c410220c7299b7fa7e4235b75698"], 0x2c}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'team_slave_0\x00'}) open(&(0x7f0000000180)='./file0\x00', 0x200202, 0x1) 18:12:50 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x1}, 0x2, 0x1}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0xcf, @none, 0x64df}, 0xe) clock_gettime(0x0, &(0x7f0000000640)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f00000005c0)=[{{&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000280)=[{&(0x7f0000000140)=""/202, 0xca}, {&(0x7f0000000240)=""/64, 0x40}], 0x2, &(0x7f00000002c0)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}}, {{&(0x7f0000000340)=@abs, 0x6e, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/157, 0x9d}, {&(0x7f0000000480)=""/59, 0x3b}], 0x2, &(0x7f0000000500)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb8}}], 0x2, 0x2060, &(0x7f0000000680)={r1, r2+60000000}) fstatfs(r3, &(0x7f00000006c0)=""/158) 18:12:50 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:50 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) write$binfmt_script(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="2321202e2f66696c6530202f7573626d6f6e230020aaaaaaaaaa0ae6c1b7287d22bc79262ea97e67d16dd45d1baea0af9412b4eef0db3ca68ff1501d93bec446543972d1b587011e89281b3d00cdc9bc5a4d5ddacc4a28106453ca58053f8927ab2f74aa84fb4a69e6ce"], 0x6e) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) setsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000080)={0x0, 0xb0}, 0x2) bind$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x7, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xfff, 0x2}, 0xe) syz_open_dev$usbmon(&(0x7f0000000000), 0x840, 0x28500) openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) r3 = openat$sr(0xffffffffffffff9c, &(0x7f0000000100), 0x600, 0x0) connect$bt_l2cap(r3, &(0x7f0000000140)={0x1f, 0x6, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x6}, 0xe) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) close_range(r2, r0, 0x2) 18:12:50 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x113142) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:12:50 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:12:50 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000000)={'\x00', 0x6, 0x1000, 0x1f, 0x2, 0xfc}) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:12:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffd, 0x20180) write(r0, &(0x7f0000000240)="32999a17616c8e95f86deb5631bdf3616c5487978d4546919d06bd9e", 0x1c) 18:12:50 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) write$P9_RAUTH(r0, &(0x7f0000000140)={0x14, 0x67, 0x2, {0x0, 0x3, 0x6}}, 0x14) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000180)={{r0}, 0x0, 0x9, 0x8}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) connect$bt_l2cap(r2, &(0x7f00000000c0)={0x1f, 0x20, @none, 0x78, 0x2}, 0xe) [ 1803.864877] blktrace: Concurrent blktraces are not allowed on sg0 18:12:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0xa400) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:12:51 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x31, &(0x7f0000004b80)={0x0, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x108) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r2 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:12:51 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000040)="6cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86d6d890d3769054aeb5635bdf3616c5487978d4546919d06bd9e0000000000", 0x37) 18:12:51 executing program 1: get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x3c73eef3, &(0x7f0000ffe000/0x2000)=nil, 0x2) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) 18:12:51 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:12:51 executing program 2: r0 = socket$unix(0x1, 0x5, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) write$binfmt_script(r1, &(0x7f0000000680)={'#! ', './file0', [{0x20, ':(\\/!'}, {0x20, 'fowner'}, {0x20, 'measure'}, {0x20, 'audit'}], 0xa, "ca5006b9816cfc33f26f01e05db580dd761111319477424fc7bdf887e774786923d9e6673ca18800327fb85a9aa36453afa1883b758fb2b02e4896d81806fdee5c8e2e49dc7f3903b23db82b6cff908f6a76bf923c53ecafc747974af4a1c26e6cb377ebc88ef76ac2d02027d20b09adb5294e49f6426a33121005d6f19ed1f57fc690199abc07c77a119ae4e4440d4f1410cee8ebcd4caf5edad3393ffe6f7a8e5c9695698da110d4f19e280cb803fbfae8b3510231301f7413d03153e68055e677819da51b17b64b9cc974"}, 0xf2) bind$unix(r0, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f0000000300)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) listen(r2, 0x7f) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) accept4$unix(r0, &(0x7f0000000440), 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/timers\x00', 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x2000000, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@noextend}, {@fscache}], [{@audit}, {@fowner_eq}, {@measure}, {@dont_hash}, {@context={'context', 0x3d, 'root'}}]}}) r5 = socket$unix(0x1, 0x5, 0x0) connect$unix(r5, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) 18:12:51 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:12:51 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='pids.current\x00', 0x0, 0x0) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000000)=0xc0, 0x1) connect$bt_l2cap(r1, &(0x7f00000000c0)={0x1f, 0xfffe}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @none, 0xffff, 0x2}, 0xe) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000040)={r1, 0x100, 0x6, 0x2}) connect$bt_l2cap(r2, &(0x7f0000000200)={0x1f, 0x100, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x1}, 0xe) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0xa6000, 0x0) connect$bt_l2cap(r3, &(0x7f00000001c0)={0x1f, 0xfffa, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x6}, 0xfffffffffffffeb7) connect$bt_l2cap(r0, &(0x7f0000000140)={0x1f, 0xc510, @none, 0x0, 0x2}, 0xe) [ 1804.581606] SELinux: security_context_str_to_sid (root) failed with errno=-22 18:12:51 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) r2 = timerfd_create(0x3, 0x0) pread64(r2, &(0x7f0000000100)=""/228, 0xe4, 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)={0xbc, 0x1, 0x8, "a350a66ef3a35244e8c794984f031034cbdda083e117330a89da7907a5ebbb402ee5f1dd91a5de8c0be491c3b203db1cbbf5d53526fe040d0efdb08e3c29cece80f00a33f29d4962618b3bdbcbbabd55f9ccb7f9db53e72e841f1bc93fa56ae937dab44f3716b56d5c6c02083dec21a5844b066a4dad8849cf4de31efc4c52947fb2f92e3d53ed09df492154ae685e67b5875ab63c65951dd9c7493f945c3541a308a966901c29e80f74445c2e31cd3004e2fcb4129f04aed519e2ad"}) [ 1804.633810] SELinux: security_context_str_to_sid (root) failed with errno=-22 18:13:11 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000040)="6cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86d6d890d3769054aeb5635bdf3616c5487978d4546919d06bd9e0000000000", 0x37) 18:13:11 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:13:11 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:13:11 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe}, 0xe) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000140)={0x0, 0x4, 0x5, 0x1}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000000540)={0x4, 0x2, {0xa1d6, @usage=0x3, 0x0, 0xbf7, 0xfff, 0x2, 0x488e, 0x7fffffff, 0x8, @struct={0x3}, 0x9c5, 0x0, [0x40, 0x101, 0x2, 0x5, 0x6ee00000, 0x7e87]}, {0x6, @usage=0x800, r1, 0x0, 0x69f5, 0x8, 0x0, 0x5, 0x100, @struct={0x7, 0x8}, 0x2, 0x5, [0x1f, 0x0, 0x8, 0x80000000, 0x0, 0x9]}, {0x81, @struct={0xb6b8, 0x5}, 0x0, 0x1000, 0x100000001, 0x8, 0xe660, 0x4, 0x8, @struct={0x0, 0x1}, 0x5276, 0x400, [0x400, 0x93, 0x4, 0xfffffffffffffff8, 0x9, 0x8]}, {0x1, 0x6, 0x4}}) 18:13:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:13:11 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000000), &(0x7f00000000c0)=0x68) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f0000000140)) fork() ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) bind$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x1ff, @any, 0x0, 0x1}, 0xe) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) r4 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r4}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f0000000340)={0x10000005}) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000140)='./file0\x00', r5, 0x0) sendmsg$nl_netfilter(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, 0x14, 0xa935bef44ff48b65, 0x101, 0x70bd2d, 0x25dfdbfd, {0xa}, [@typed={0xc, 0x69, 0x0, 0x0, @u64=0x14}, @typed={0x8, 0x21, 0x0, 0x0, @uid=r5}, @nested={0x8, 0x93, 0x0, 0x1, [@typed={0x4, 0x3e}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x40440c0}, 0x20005880) 18:13:11 executing program 5: r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x8, &(0x7f0000000040)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)={0x3, 'geneve1\x00', {0x9e2}, 0x4}) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:13:11 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:13:11 executing program 7: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) write(r0, &(0x7f00000002c0)="32999a17616cc86e4b4f93ea2b05440e95f86def5635bdf3616c5487888d4546a33179689e5283043d5c17aaf321fc7e837e91d7573490f9fba70a68e4f1d1a1e4fd7bf4f70ec0159cf82646e42afae9c3f96fa31dcb0b82364784fc0cfa134516460ca08267ba3b09e9098e055b928c00fbbc6bccf9e306f37f3e714936af92f08add360ce7a4c3edcb12cf0d064c009c5972aae9ee1adf94d1ad2be94b9adaf0766bf935502cf28d31d99cd10429045834e1935cde47004f0a7693880fd2ed4066a947dcc71d4c59b80e068ead69f3b0249177002e5a37c2016aededfd4ad6416fddea76ad242c3205a5ca0de395164e782296fe1386d8f847730e37900e2a8cb57989ebd2d59600000475f9175add673eae3a606ed3a7528227a838646f00881a217c5de0ac9feaa4046b1f6fa57d8ed2f18ac76fd75715bc079833659f31a9a9df706400", 0x146) 18:13:11 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$IP_SET_OP_GET_FNAME(r1, 0x1, 0x53, &(0x7f0000000000)={0x8, 0x7, 0x0, 'syz2\x00'}, &(0x7f0000000040)=0x2c) 18:13:11 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe}, 0xe) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000140)={0x0, 0x4, 0x5, 0x1}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000000540)={0x4, 0x2, {0xa1d6, @usage=0x3, 0x0, 0xbf7, 0xfff, 0x2, 0x488e, 0x7fffffff, 0x8, @struct={0x3}, 0x9c5, 0x0, [0x40, 0x101, 0x2, 0x5, 0x6ee00000, 0x7e87]}, {0x6, @usage=0x800, r1, 0x0, 0x69f5, 0x8, 0x0, 0x5, 0x100, @struct={0x7, 0x8}, 0x2, 0x5, [0x1f, 0x0, 0x8, 0x80000000, 0x0, 0x9]}, {0x81, @struct={0xb6b8, 0x5}, 0x0, 0x1000, 0x100000001, 0x8, 0xe660, 0x4, 0x8, @struct={0x0, 0x1}, 0x5276, 0x400, [0x400, 0x93, 0x4, 0xfffffffffffffff8, 0x9, 0x8]}, {0x1, 0x6, 0x4}}) 18:13:11 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x808240) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x0, 0x400, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xab1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x88}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xd3}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40801}, 0x41) 18:13:11 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='blkio.bfq.sectors_recursive\x00', 0x0, 0x0) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, 0x453, 0x400, 0x70bd2c, 0x25dfdbfd, "f2a23eab9c44b77b8ed0f280bea731be018b56c6933132a32ec71078187004e2f9c98dc53fe9736925c0b27a17242b95322e8864f39d4cf6a2064d2dc542b195", [""]}, 0x50}, 0x1, 0x0, 0x0, 0x4001}, 0x4) r1 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffc, 0x20002) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) perf_event_open(&(0x7f0000000300)={0x2, 0x80, 0x4, 0x80, 0x6, 0x0, 0x0, 0x4, 0x8043d, 0x8, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80000000, 0x2, @perf_bp={&(0x7f00000002c0)}, 0x200, 0x0, 0x5, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x7, r2, 0x1) close(r1) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x8c4f644deec645de, &(0x7f0000000040)=""/182, &(0x7f0000000100)=0xb6) 18:13:11 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/keycreate\x00', 0x2, 0x0) dup3(r0, r1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="040100001000010000000000010100000000000000000000000000000000ff0200004cc9000000000000480a972700"/62, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc000000000000000000000000000000000000003c000000fe88000000000000000000000000000100000000000000000000de00000000000000000000000000000000000000000000000000000000000000000900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000014000e00ac1e000100"/184], 0x104}}, 0x0) 18:13:11 executing program 0: bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x7, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7f, 0x2}, 0xe) 18:13:11 executing program 5: sendmsg(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000000c0)=@can, 0x80, &(0x7f0000000400)=[{&(0x7f0000000140)="620f5eae1ee31ba6a6e52e1cc6786c92f33dd3ee88816467b8efd8952098341c1603fc2877fd771343780c3c683db35dce14070e10751927a37cf85f2f5be701001f61660795c8a7ffd70b8c48e53019092cb628f86ddc2800ec49910d2332fe445067b8487783ae62f31f586810361cfe561fec67d6e3e0cfd9d44cd1c8ebcc7486cba369e4a66cec62e4ee8946b497a58c4227935412c1", 0x98}, {&(0x7f0000000200)="a50da2d1bc8a8470abbe52939c48ab92bdc66ed9e4d403aed900e623cb270480ff3b773115ead0a499387a1e009cb7c0812ee3a37a29e6d93ad066000436bd6afbb52654e6e87c3f6a3fb17bed022655269dc4d3e82f6132d38ec25f1d0ade35feae2f7bd6c039ec42eb21e354bac7ec9c8e2e2896bbe0b9c3676e7df920ad98fa74c92f642b1eed2754187b5fa2196bc1b8e9a6acd5d80a189d2d737bb8ba7bbbdac1c296b832bcc512fbb17001843a53d55a2a4eb25742f2ec0070b4843a5cfca9dd0039d6ff85a5ea5f51c77aa078993238ba7f1c1e08d775ae48c21cbbf2052a9b76df", 0xe5}, {&(0x7f0000000300)="eb0c7500847af4678aaaa7b189b26c7f29840e7929e79e6481f6887a39fbc4f4554479b4b73201994b60dc9461d46d633db6d345f48f7f488dcd38360a3cdd0eddf36c7c59ba13a68fe1900b947e89dcda887805b4b7e49d78b1111a862534269938ae05a2ae771f3b2371916c02bae7446558c5bb0a6f65cbca119a693c8da0bb4afaafd4ef70e97ae36cdb4254e19e31cf1eff264eb0566b86b52d624b9a30e10bff842725d19417a7cec2c0030993402ff6cbc52ccf87ff0f9dd4a800b1ab9d81c8534f78586763c08447a5d68eacd7b373a4e1fd48cf304a5df28c5e11", 0xdf}], 0x3, &(0x7f0000001040)=[{0x108, 0x29, 0xfffffff8, "76a9ee0d274ec609b7533698316754d082194780d4edc28c3a29f85a42def945f381a2f061269ca301735496e692a9b1a913d387be4cb57800f32aac6726a28365b2ececc320a2b4a47b92a76e92dbd9b13c26abb43982a7e7aed8b09e045535615bc976b4d64d4c328f607857cd5c7f1a492d46be2ee5f1169cd226be66a9bf13675bbaee4a702f56931c2cdef42d1bf17365a597f9f40e679d2d2c39a3f56f6ceb67a1a26dc6d6d8707024f11581c612f87ad7abee1e9bde0e32854f292f574825d500470b03bbe48fcc4a3dfbb5ab3d4273d2f2abe4cdec82f625c4e286040a33853960e1e65d2eae5715923c5b07dec2d0"}, {0x1010, 0x116, 0x1, "73f4ad6d17d56ecf5202c7c531accbeca47a9b1263d04326a3ad69232214ee81d7132aa98d31e4ad48687a46b6e4d21c0475b177af46b5eb12979e283cc629f010e05c09ec06c0882f0039b35defd48967607883eb58d64b15e71c551c15c5df2812f8f7ba139c5afdfc9e63dab3034c14e3cec94047d6ebb45bc7409a1a0b2008570fec9a72b1543858cc8f7a1ec9ae39a0a58307bd9f33a202a331f0de7d097356028954b01c79dced838eaf2afb6570ae314c7bc85b0e1ec780ea7fff52b5fda9ff4fefd20350b1a2d6807b86e49669b0558b6fbe0daf4dadb23304cbf0bbce68b7662487d92ab866ee3d514dc0365e4bc292abeed0340fb5d6ce17283b826e7eafe87df4a0b5f8bd1610ff556b138cd63f489df8e16d537a279959495499af657da4a5a4ff39f169da39ab22238b568014dc542bb3ad0198e1d3ad19a45763a94b402387f92990f494e6f86d1186e39d3f6e0f4ddbc82f469aec0a8064e9f95bd62171f87f25121f9f708cb5472c34f894123e3ae88a1c8936c85b34f5e14559d7506c30a8fc88585d3a9431009dcab90123bf2231fe0ab058bfba2685f050bc065770f481bfd657a71fc3974d10e54c073fb0ff6556fb84d5326660c9ffbaa50f8c16f17d325b6bfa104bf7571f127cc4497d35913235a2b97352a2454a3f29c3bde629ac58207d04464f31a9e4e9ea592accca1ed21fc7cd8b6a7e87642cceb8adfa4c903efbe58e463f3c1a50033491a86354a08fd4949c244284a59543e41f651e9d40ec710f5eb765a386504e5ba2c0187797ab1ebf555d2fd0e606115b8b47618e8b94945fc78f2bc3ace0b26a880e10bb8090f1ef9d7ecb56cc857b910a56437d1c2ecaf60ccc99d56d0864946d3af2b41f23d37c43c2847a371e405ea1214423e831f296d0edad2e51fa56f7d18796221bbb9326809901be21117e26c2ed297faa60ff4364b5ae8eb0ed50c840f1af473f97a7f3acc33489767522de44c2534c5a62529ae7afe669addee3896f50d4ecdc318d23ac942a56175f7622695fbc2f8aca8a023233911c507eeae4adca7b865d4f5bc3aef425cd3a1c3aeb73addbe843fbc0a3557db666e3f7125d1a3376555baf057cd00d4691f117fa0384807b67a45131ab1418ab261b0f45986f8e242b4d8d9a23426283555f55b806c1c647f1a24f120dfda7abf0074552d4ed363632c39b4a6a2ddeb866461a5f62530503b071794e07009dd33669595bbbdaa84f24eb70a8f2906515ed6f1d6de23913dff2ee118daeb5eee4a8068d9f543af64df7d0e9c9d46a7d065185b4a4a237f50e904babb0280d7806124405aebd94d23a0548d9a799306e361278a94827eab1ea2f6c52b7466338797bb5aa6eb6f182fd3bd676eb896243e4dc4af238bbd9dc807ce9658aeb5e41c52af4e11978462881ed2d947be3c1ed5a170ca13bf03c1dbefc4633a602e2728b72dd2069422a23ad403f3e8096d6bbde7f659e9d22ea3125f487b61aff8c1b059db00494bf4d01b60c9adaf4ea1e67baf0705b38085656b7d1846d0a9f6a92942c3a483f11318d9066c4c116df986825325433130a82e783c670be81d9b16c1bd2b7494ef00ab75aa33f450eeb2c422279cbad3d7b20f8468f115c7f07a9f6099c3ebe780fa2518b769d0cd1e20be5bfcbae18e92a9b9c84d88c644890639541b232381f2cb047b08f213c9b4ea6d8ced298c097b914d850563413d0b366c944a31bdd3db561dc6509533fcefa08e7b3b09af6080fd835a6e56dc90dbb760f7135d6a1ea094270fe9c387d8b0a845fffe73b7308dc6570a82c4e2dd8df99707b0a045c697be1eb64fe94ee2653c616fb01e8ffffad057d7007a291d86746bc248b5d49280c72be1e012515dac794b6711cfd2726fd1e093140d725dc271eb0840b6f5b40e5d3d1dd1420df31b8938f5fce497533b3be0c76d46285656c5d4fce092a67902e3ef93dde76753a51e7f7fd0de9b24dd370851ffff571f02303d7693d881146ad094424931cac80c26a2c4c68f1f6c43ad6ea432dc5af1ace89b6d5c61100edd661d1ce4774d7cf766f1cfc87cd929a7332b3f8210970439beb7a0f382cf37b716163fc3bc7dd0560197bb7b3c188bf76c941cf541be0ee84e9ed8fb93d3a4a4305252d77cf369d77397d61f6ea7a4321fe51014948e8a599838a7244edea319dae9f75f106f5c7084dcf83f3b34c83542dcb1bd1504b34898c3f92b1ac56b6f03002b9467e8e1b3aaa2a996f7d950402e8f33b0766b000380859e166fe169f6c25a0f65ed452089e1479c790acab4b7c0392cd2348c7e2132b1e023cefb2b75ed76b4db612e21b3b273bcf34a8c78a7b6063edc4959175c76cec95ae117d719ad52692b9dae95c0f8abec8da98c11a9c03c115a801274bea54fe5986b13107f5c8675007efdc8fb237afe82af9250b6fbee5983f06f5b080e38aeeb3d11c82a52a8c573867175c6fdd0ef3dbe6696f9b6aa7f30e9747e5af562217f571399762c854b76d60ecc2f969a9b93dd22764e6df8afebadb18c7010d7b30942e09a7f469afe12386e3364b72525d0a0484a44575fef6aa04d7a92dd291739ed1f102e53193d56e111f463d713fef2da7b4668e25d6e826108b4a914a1c606f10679f4773e7907384f2ba849807411cda06f204dccecc448cac31a10e8f83cbed16272d68689062116e1aa92a2620eb3bee5fbddc4773f048eb4a61f74cc62c7ed0d4fc397e6513da6f58097dde0993d6387b8fa4066669deb6117bbf0fc93835d8a7ed6de0d5368832e0de7ab4cda2fce5e4c6023e3bb28d5548ed0205b813918a534969fcc40fb540469778e198d8651feff32b4a8c4caa573a6047474b7cec2c1678e08e3b10ba17094fdca28b09eb35746e4c0c827d1c7aba4caf3e6fca3ebffdc6b8aed17291ab8e371d0903fd26c97dd9a862d0eb94c97e22c5818b89fe7ff506a9723abd870938c2a8894534269068cb2600e7f04effa3302b00f92d67f2f86bb4534db85dad03830fab124aea54899d997430d85b2a8c3e0f0a4c2e070ba4a1a452bfd33a53b57e7191833717716a54f98339e1ae46f7a7e8bcd8cc41f1de8fbf968ef17e6325f58c91bc44c282d2bdf07485ccc3daa861635e4507a975a5a02f9a653bbce75425f486a075e38155ab7f3b041dfd6b450bfd7df0bd55b443bc324ff54d95a9907029d13961db1b05b3ad57c15aa02a07b3840e8fa956d6bac519be0366360766c51e0f21e43d06c81a39f6373c3705025e4e35293c3af32b3cd59c14725aac2df2fb986869ef4a2fbcab51edd868412b72c20cbdd419a86fa766ff9a3702f0395c30b95c71f36d1b5fae9c80d1046cb88ee4c07fb66ebef23020de6d48dc10f80cd9e53ecc54cbd8d8f6b30d29d025af11fe3f3f41549149f24c7a98b7bb9276fe906d1550b2ac5119a09afcc3aae3808710e52f542819579be7cef14b01f48468e7d8e97f81a7800465a8bc9e7dc9f57011ed00cdac61ca46a580e70abf7e5f4068a47b1f0e9c7a826ffcdff1e8ed8863b578518d8b0baebd13109d168c171470321d682cabb4712003a5403d38e00a88bdeffeb731b0183f32126b9bc9f93485918da166e2d1665ecb8028e21c478226d5e74756bde5f336fb0f2cc06e18e47c121bd825211fb92d7b104fa1c7a29930f7b4acfaf3439499b96f60a219aed9a4535ae422f3099b9bf2f24c458f3d5081a47c35499d0ae6fbeee9ac3ae90ebc953170c96bece22c3e3ca25b8ac2975ca84b49af7d8b52929186c8269ed45f5ccd1a013c650bd16bf1551d652c803ab53c7f1bf714cfa8b2fb8cda5884cde2a52911551956e590e57e9ccfbf3f4aa425b069e005517279133557b3601a4c814c041b2438eb2135ff63bad65943354bbc6f4bb4d3822bb23d1ed52fcf19459d6cfaf439af68fff65fa8404df14b5c84bffd2d0aeaa91e8a4430b69197bfa05ed597197934c13a046e09b4b7df2f76725a98e4d7954adb877295f831bce4c9716c76ac755d2bd812907371ff2d292bb423e1fa03d82ed965dbec7c705de54a5713c20131158715f9f741f07aca00cd21625db2e3033af9aeceb559f558834cf6036e90c560734f662420f22526e440ec6c0acb5bac045e171e01db5014b537f0895841b3b29fc7ba0f3de274a08ee000d11fd9d8d6560d7a79d1f1f054681cba97e6f5dc8dea81eb0860970dac5df186718aea900c8815d8c1055c0a179c5043b1fe95a8ad5a1c4a5109e865dc3140fb934b435a658c7d6b284cde538d15d6ab494ddc6005852f7cccddb9d1f379fdc6257cdf248ed882569147763198f240e1eda6d5178a6b519f8faad9732f158895cee7841a46e123054a138a9cc29eaed6b3c33d5ff6a3e75609e191d823a4d152d422effd03e93686cfa4830f15b9413f2455ff622f84e24b86de92bdad96c555e0d0b200e947372e3829545c1593f902a6f4ea5449e60b5f0c9a3581d875cace1cd856d81c1d58439c1f2f1ee594fc24697f26a381ce23184499112bf2db58d020810cedaea6e35b53c8ad4216b93db9a42479befaca60a9156bc33e35e4a66c3b3b622b252af468e7f64a4448956bad1ba3fab3fbf86a4117fea8b894da33acebfc48442538acafdcd8d10e04b1909dc9ad4d80c0715ee85c7d69447f0e508be8c969d374d52ee17858b81156c05ba2f036d2f97b736967d52e163671e39766915687db68fce564d4e65d398e7c96d499ea0bbc066817236905e9e3dff7e96b45fe7810e221562474de1061f268423e4cc95b9e6602df962e10f1755b723d003c5160e90b4e0e277b3c70297c4df59aecf94ae7c1244ca537ece1338b8c06549a8acb7f9e246d7df505ccf266a1e73745c84db404f430e9b70d1f5c4811481f056382ffd25b34ff05c1096f103c336b9322b32274c39fdb9d44427743e4da9f1757077df9f4782f5e6f611cc181daa9dbcc01c39f74901988d91c70288881d8b8e6fea7b85a0f8943f34fbc6dcbcabd042cb0fbe4ecf3bcecbe4c719ce4b161bca38523d7ceebd7ba4e6ebead9cc8e772dea5f6bef6c036420f66646f4847cc2cdac6de81904b2a6d31382dd2c126496526fe34358447376dbc4c396ace782920dd45714983d4406f475976f8b6a333b8225f7d96119e22022eb004daef2f67ba2ceee977e95971dea5428a689c532aa61268ea555ced9ed155b0a03e04e3c482711391c8e42997b8c189a3d23a62b917d8eac123857b775f87ddef9638f4bc5934c6509d3b7b008d3a1c341689516d7505c5b183b4a6badd977eb606d592133c46239c69acf2d804f1a1580b3de6809301ab5163045384c994f139918b50f78132a51de1f7b82d38b7f8020424adeb57de8a8075db725423551e4198c69ceb3e11195ea1c74847849a01632ada9e5686356180ee377701437d8ca3a353090423d509ca21b35ea72d8c54aefadbf56270278ec2d6ecd2632915e9cd08066d1245ad6b246ce234230f3fcb50eafb6b41d76d5d05e2a76c30bed98cd98448418bfc22f6d452c5f2167bba4007c436911f9e8d266a5de0512e9ff5dbb36dff02e5812dedd0e63ac1c2852e8e3e1cd5d97dae8d2e19fae007939da2a5689bbca5a8b88fe8cce379aaf05670e8d058d8764186b5d32d537cd1a9107eb077a6548a8dbed5eed10092dc22f74ec0fa04fb707e0c862ee4c1b65129c5e6252de41291810b5e814a76d082498a968657db79c396c0cfe6aa1111e16f3a581440134d44b24ed9dd5cdbaada77152dc42f7ecb32300ef1338e2241a2e5"}, {0xa0, 0x110, 0x9, "b25a746666d670a59a4e257dfce5d12498a93fb2cce7814afc7c367bb3ae496ece461ce676155679d25799d2c3723ff6a850105f9e21e15bb068359c5d27e45d9135d3ce7f267f2c9739754d30b469a219b5cb13fc3426e11eaf4f0c03befa646ba7faa80bbe5fd723ae749448670b806222552d712f7ed168f90d94fff95af3ff779dce2077dbf6189d1e3eef5d"}, {0xd8, 0xff, 0x80, "bf8840316d749e4a16acedb04f52081813fa7f31a026c0432eed30ad77a8eeffffe8bff2f02017f6c9eb4d0aeb4e89f76746cba859f520a4d0f148e2d068851d8fcf351dcb862083e58c126eaa578c2bca65babab7138b61118165b80f94e4ca0510df6e77318e9d3a141aa7d62c1f1e812e860db759df155fc8eb306a61de2bda76747e1777427aa1f8df059e794d00a1e3670b8cd4ef44228f3a996a74bb6a1d35be028459554a1859a623bbe2bfdb42d3f2e35d46de7f6d4bcfc2a40ccf3a8c7f51"}, {0xd8, 0x10a, 0x1, "7b8f188a456e73e588274294cd0b34d449a42bb4e2a68e1477a4ce058950816e4a2153f479d6d766b8f9e21f09fede5067cf9de660caec80c2ec5f45d09917675e0e39f951a7debe93dffb2b68db8da52b06761816df005f8df7a67eefafb5dc06e60bd5d8656e801e3a11d6d17eebac90b724b30cef843842c1041e7be19f52b838def50610bbd29fb47300b63622ed5acf337f54f37990a6e58bf3eda45c07cf8ee8c6758fecf5a5164f548c3edf8dfc59043013af916b38a455e6e11176c7f1"}, {0x70, 0x10e, 0x0, "b3b9604ee696b5e46a31caeefd0750c72fa339365066cdf4b8e7778bbb3e32eace2607e0bc88a0710fa053e6d4213f673e5af5b889642379221caced34113c74bdf7c6943ef3b8e2b4cf43290be262ada6a03dfe7855e585bdc7b52ea3"}], 0x13d8}, 0x4004000) r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a17619fa2aa4062d128bb6a181bd16b056cc86e4b4f717dd3e22765707edb00a43fea2b05448e95170c45bd35bdf3616c5487978d4546919d06bd9e6fbd66d13e6e59fee5d13366a85d9667cc200005a199248eb55dd6e89ee6f8f95ee0a495837ab1019c08ff3385631e67131ce55f7ac972f76d3f75a373d695545d3f89766c33dd43f9f68f7fea27ff39b5df5027479716a92cb1e67ead5af9919edd745308a1b249cd2d6e944de5eb0254dcd293", 0xb2) [ 1825.141739] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 1841.342991] tmpfs: Bad value for 'mpol' [ 1841.345452] tmpfs: Bad value for 'mpol' 18:13:28 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:13:28 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:13:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:13:28 executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x102, @fixed, 0x0, 0x1}, 0xe) r1 = syz_open_procfs$userns(0x0, &(0x7f0000000000)) ioctl$F2FS_IOC_FLUSH_DEVICE(r1, 0x4008f50a, &(0x7f0000000040)={0x200}) 18:13:28 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x105100, 0x10) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r1, 0xf501, 0x0) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xb, 0x20010, r1, 0x0) r3 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x200000b, 0x110, r3, 0xac93b000) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_FALLOCATE={0x11, 0x4, 0x0, @fd_index, 0xbf, 0x0, 0x1, 0x0, 0x1, {0x0, r4}}, 0x5) sendmsg$AUDIT_TTY_SET(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x18, 0x3f9, 0x200, 0x70bd29, 0x25dfdbfb, {0x0, 0x1}, ["", "", "", "", "", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/meminfo\x00', 0x0, 0x0) r5 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r5, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r5, 0x400454cd, 0x30c) ioctl(r5, 0x80000000, &(0x7f0000000280)="c9df5d05d1f8e2f5dba0470bc77896a02fc60b1b951ad0e7e58c3d0f399f6490bfb13f6283add4a0d90b0d04531900f14ed53f4c3873a667db626acb0ed68294f482ef7669ecb5e500f878f87c54e682c46fc6eee81c5c450cb96e183b883e3fd0323dac2a711ba03bfc8c8c6b7d6092a1ce4e6f3979464b36710a56f615678c61a634ae66b47e4c200f5942335597837cdcefc9ac22e816caff7cba256887adfef27e5596c8a01c3e30bfdda7fb82d16714024d73801ce9ecc74ea15c2d1230760e5249cdd79440aac0c6c38d111b0e7dbf24dc7a056d1b1ce5ad32aee604541a") ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f00000001c0)) 18:13:28 executing program 2: r0 = syz_mount_image$tmpfs(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6d706f6c3d6c6f63616c3d72656c61746976652ccb"]) mknodat$loop(r0, &(0x7f0000000000)='./file0\x00', 0x1, 0x1) 18:13:28 executing program 5: write(0xffffffffffffffff, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r0 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r0}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) signalfd(0xffffffffffffffff, &(0x7f0000000000), 0x8) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0x3, 0x10000) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000600)=[{&(0x7f0000000080)=""/131, 0x83}, {&(0x7f0000000140)=""/82, 0x52}, {&(0x7f0000000280)=""/235, 0xeb}, {&(0x7f0000000380)=""/138, 0x8a}, {&(0x7f0000000440)=""/206, 0xce}, {&(0x7f0000000540)=""/145, 0x91}, {&(0x7f00000001c0)=""/127, 0x7f}], 0x7) 18:13:28 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x4, @any, 0x2, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) 18:13:28 executing program 2: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000380)='./file0\x00', 0x4, 0x2, &(0x7f0000000240)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0xffffffffffffffff}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) openat(r1, &(0x7f0000000300)='./file1\x00', 0xaf03, 0x20) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sysvipc/shm\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3}}, './file1/file0\x00'}) chroot(&(0x7f0000000000)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0x7}, 0x15182, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000400)) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$unix(0xffffffffffffffff, &(0x7f00000005c0), 0x0, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) mmap$perf(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x8, 0x8010, 0xffffffffffffffff, 0x8) sendfile(r2, r0, 0x0, 0xfffffdef) 18:13:28 executing program 0: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x6b8}}, './file0\x00'}) ioctl$TIOCSBRK(r0, 0x5427) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x46e8, @fixed, 0x0, 0x1}, 0xe) eventfd2(0x1, 0x1) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) 18:13:28 executing program 7: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)) r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a17616c4f757dd33c8b98c47edb616c5487978d4546919d06bd9e00000000000000000000eaff00000000000000", 0x30) [ 1841.524954] sg_write: data in/out 1968139325/6 bytes for SCSI command 0x0-- guessing data in; [ 1841.524954] program syz-executor.7 not setting count and/or reply_len properly 18:13:28 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @none}, 0xe) [ 1841.538748] sg_write: data in/out 1968139325/6 bytes for SCSI command 0x0-- guessing data in; [ 1841.538748] program syz-executor.7 not setting count and/or reply_len properly 18:13:28 executing program 5: r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x84, 0x3, 0x1, 0x201, 0x0, 0x0, {0x3, 0x0, 0x4}, [@CTA_LABELS_MASK={0x10, 0x17, [0x5, 0x8, 0x800]}, @CTA_NAT_DST={0x4}, @CTA_NAT_DST={0x14, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @broadcast}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x41}}]}, @CTA_SYNPROXY={0x3c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x401}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x15a}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x32b}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0xffff}]}, @CTA_HELP={0xc, 0x5, 0x0, 0x1, {0x8, 0x1, 'RAS\x00'}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:13:28 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = accept(r0, 0x0, &(0x7f0000000000)) bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0xfc, @any, 0xb}, 0xe) 18:13:28 executing program 7: preadv2(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000000000)=""/137, 0x89}, {&(0x7f00000000c0)=""/127, 0x7f}, {&(0x7f0000000140)=""/176, 0xb0}, {&(0x7f0000000200)=""/24, 0x18}, {&(0x7f0000000280)=""/251, 0xfb}], 0x5, 0x5, 0x266a, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) r3 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) write$binfmt_aout(r3, &(0x7f0000000440)={{0xcc, 0x3, 0x7, 0x9, 0x295, 0xc5, 0x13a, 0x4}, "3805682e13f0a8dd6f134636333d6066a10333c5210abdac3deb29624c216041026c12944d947d384500c46dc5fed2c9603fee18a6a16c1d95e2e1b20a6d1f8248d3eaaa820cfaf82fda26d087804c2886395c2f576a023c11278ff152bbc5199c578d3c9f6d2697fbd69dc31a27be587400149e757bc573e6db84033dda3f4fbf6c3c77c1fc596f3b8a59334c7bd00b221cd47566bcf3357a5cc8e3a22a9d437e183d5e4f2752bbeccb26222f63"}, 0xce) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:13:46 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f0000000000), 0x5, 0x400000) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) dup3(r2, r3, 0x80000) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000040)={0x38, ""/56}) 18:13:46 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:13:46 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000000)={0x2, 0xfff7, 0xcb, 0x1f, 0x3b, 0x4b, 0x8}, 0xc) 18:13:46 executing program 2: r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="b8000e00518cc2d49ce655972f452b2769edcadd15d2fc09f7ab5cb3c5782e9678f69926200865cccb7b350fdd634606000000000000000000000000000061fe08eee04879f7b56b78bb9eb8d0734780d556f21e26f5ab2559dde35a50fd98d62e2305671121e2981e65355eef2fb89f8ab0d4ad47e0eb16be87ed46018d93adde83e44a0252e916fa00d0e71a2a2f5f8f13c9ab7a09ded5", @ANYRES16=0x0, @ANYBLOB="10002abd7000ffdbdf25070000003800028006000f00ff00000005000d00010000000800040055fe000014000100fe8800000000000000000000000001010800090004000000080004000700000034000380080003000400000014000600fe88000000000000000000000000000114000200697036746e6c300000000000000000002c00028008000600000100000800050002000000060002004e230000060002004e24000008000900000000000800050008000000"], 0xbc}, 0x1, 0x0, 0x0, 0x1}, 0x91) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="001300000000000000000007000000d8c931000d0000002f6465762f73672300000000"], 0x28}], 0x1}, 0x0) sendmsg$netlink(r1, &(0x7f0000000140)={&(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x94}, 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f0000000180)=0x2) 18:13:46 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:13:46 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/usblp', 0x40080, 0xd2) accept4$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed}, &(0x7f0000000080)=0xe, 0x800) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0xfe, @fixed, 0x0, 0x1}, 0xe) 18:13:46 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a17616cc86e4b4f757dd33c8b98c4f56092ea3deeb670dc6513d525077edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x3e) 18:13:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:13:46 executing program 0: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 1859.969578] sg_write: data in/out 1858628669/16 bytes for SCSI command 0xea-- guessing data in; [ 1859.969578] program syz-executor.7 not setting count and/or reply_len properly [ 1860.010739] Zero length message leads to an empty skb 18:13:46 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000000)) 18:13:46 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0xffff, @none, 0x3f, 0x2}, 0xe) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x7fff}}, './file0\x00'}) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x8, @none, 0xffff, 0x2}, 0xe) 18:13:46 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = syz_open_dev$vcsu(&(0x7f00000000c0), 0x7fff, 0x8000) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000100), &(0x7f0000000140), 0x2, 0x3) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18}, './file0\x00'}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x9cafb958c3c601f7, 0x0) write(r2, &(0x7f0000000040)="ed06084aeb3b8dc9b5086a8af5ef57640fabf1357fcfd4e801dd16583d39de0272d577069269bc44278c0b19ee8005982c3a050ceaa7c694241c074bca4adae019926ffe85838543ffcc5d8fe172a214e844272238429a152587ddac0260dfc1582f63fd759eb5", 0x67) r3 = syz_open_dev$evdev(&(0x7f0000000180), 0xd44e, 0x100) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f00000001c0)={0x1, 0x21, "6ba7aae228ac4218011ac69865edcfd0bf392d6fd275daa8a64236ef6872cbd7fb"}) 18:13:46 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x40000, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect(r1, &(0x7f0000000180)=@qipcrtr={0x2a, 0x2}, 0x67) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'lo\x00'}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000001880)={[0xe31a]}, 0x8, 0x80800) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001780)={'veth0_to_bridge\x00'}) r4 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) signalfd(r4, &(0x7f0000000000)={[0x2]}, 0x8) write$binfmt_elf64(r4, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0xe1, 0x5, 0x7, 0x9, 0x2, 0x3, 0x4e6, 0x368, 0x40, 0x1d8, 0xfc000000, 0x8, 0x38, 0x1, 0x1, 0x8, 0x100}, [{0x4, 0x200, 0x4b40, 0x9, 0x9, 0x101, 0x0, 0xfffffffffffffffc}, {0x4, 0x5, 0x5, 0x4, 0x0, 0xffff, 0x4, 0x6}], "b365d449c6d40a736fea3e0063193e4d4259e0239b96d38f5e095716b194e946ea9acd9fdbd4e4f0351541112a759c32644721855c0d1f9d5905a6e0ba0ca37f93292d68809dcceec873ab8f72dcb2f632b905956a6c", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x706) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="94031c855deb"}, 0x14) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'lo\x00'}) r5 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = signalfd(r5, &(0x7f0000000000)={[0x2]}, 0x8) ioctl$BTRFS_IOC_LOGICAL_INO(r6, 0xc0389424, &(0x7f0000000100)={0xc0, 0x40, '\x00', 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 18:13:46 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) [ 1860.242196] device lo left promiscuous mode [ 1860.261636] device lo entered promiscuous mode 18:13:47 executing program 1: prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000000)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) 18:13:47 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) r2 = gettid() r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) r4 = getpgrp(r2) rt_sigqueueinfo(r4, 0xa, &(0x7f0000000140)={0x2a, 0x10000, 0x9}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000080)={r3, 0x40, 0x3, 0x80000001}) setpriority(0x1, r2, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3, 0x36, 0x0, 0x9, 0x80000001, r2}) r5 = openat$cgroup_subtree(r3, &(0x7f00000000c0), 0x2, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r5, &(0x7f0000000100)={0x80000008}) 18:13:47 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) ioctl$FS_IOC_MEASURE_VERITY(0xffffffffffffffff, 0xc0046686, &(0x7f0000000000)=ANY=[@ANYBLOB="0200730098c0520319c0738dd6d580da53437ca5adb55a9d46e92892e034bb47e7367433e7247055fad5acce5dfa0831e6dc7d21e89a66e49ad953d841e4eedaed7782bef1d5f061d61e81b27da491189004265216fd163fa0aff2c0b8de5b620fc38bb7f7259beb993355395e16b2f20923e5a4cd76f1"]) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) fcntl$addseals(r1, 0x409, 0x2) 18:14:07 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:07 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:14:07 executing program 7: setxattr$incfs_metadata(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f0000000080)="9c7e33e52659f6aed17b9d8b36c1b82bcba1228e5ebbbeedb0fc", 0x1a, 0x2) r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:14:07 executing program 1: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) syz_open_procfs(r0, &(0x7f0000000040)='net/vlan/vlan0\x00') r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x21, @none, 0x0, 0x1}, 0xe) 18:14:07 executing program 5: syz_open_dev$sg(&(0x7f0000000000), 0x1ff, 0x420200) r0 = gettid() setpriority(0x1, r0, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0x4, 0x81, 0xc0, 0x1, 0x0, 0xff, 0x4000, 0x6, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0xbc, 0x4, @perf_bp={&(0x7f0000000080), 0x8}, 0x40001, 0xfff, 0xff, 0x4, 0x9, 0xffff, 0x9, 0x0, 0x3, 0x0, 0x7ff}, 0xffffffffffffffff, 0x2, r1, 0x8) syz_open_procfs(r0, &(0x7f0000000040)='net/snmp6\x00') 18:14:07 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000140), 0x0, 0x201) dup(r0) write(r0, &(0x7f0000000180)="ac1954c789f1e7077c8a3e01c544c38fb7938271a950d254", 0x18) 18:14:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 1) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:07 executing program 0: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 1880.491250] FAULT_INJECTION: forcing a failure. [ 1880.491250] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1880.493263] CPU: 1 PID: 9697 Comm: syz-executor.4 Not tainted 6.2.0-rc1-next-20221226 #1 [ 1880.494413] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1880.495546] Call Trace: [ 1880.495912] [ 1880.496259] dump_stack_lvl+0x8f/0xb7 [ 1880.496859] should_fail_ex.cold+0x5/0xa [ 1880.497494] _copy_from_user+0x2e/0x180 [ 1880.498068] copy_msghdr_from_user+0x89/0x150 [ 1880.498740] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1880.499505] ? lock_is_held_type+0xdb/0x130 [ 1880.500128] ? find_held_lock+0x2c/0x110 [ 1880.500782] ___sys_recvmsg+0xbc/0x190 [ 1880.501398] ? __pfx____sys_recvmsg+0x10/0x10 [ 1880.502068] ? __pfx___fget_files+0x10/0x10 [ 1880.502727] ? lock_acquire+0x32/0xc0 [ 1880.503350] ? __fget_files+0x270/0x450 [ 1880.503993] ? __fget_light+0xe5/0x280 [ 1880.504656] do_recvmmsg+0x25d/0x6e0 [ 1880.505271] ? __pfx_do_recvmmsg+0x10/0x10 [ 1880.505911] ? lock_is_held_type+0xdb/0x130 [ 1880.506618] ? vfs_write+0x492/0xd90 [ 1880.507248] ? __mutex_unlock_slowpath+0x15c/0x5e0 [ 1880.508083] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1880.508933] ? syscall_enter_from_user_mode+0x21/0x50 [ 1880.509677] ? lock_is_held_type+0xdb/0x130 [ 1880.510319] __x64_sys_recvmmsg+0x213/0x270 [ 1880.510922] ? trace_rcu_dyntick+0x1a7/0x250 [ 1880.511589] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1880.512267] ? syscall_enter_from_user_mode+0x21/0x50 [ 1880.513013] ? syscall_enter_from_user_mode+0x21/0x50 [ 1880.513755] do_syscall_64+0x3f/0x90 [ 1880.514325] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 1880.515059] RIP: 0033:0x7f11096e2b19 [ 1880.515636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1880.518062] RSP: 002b:00007f1106c58188 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1880.519121] RAX: ffffffffffffffda RBX: 00007f11097f5f60 RCX: 00007f11096e2b19 [ 1880.520178] RDX: 0000000000000001 RSI: 0000000020004540 RDI: 0000000000000003 [ 1880.521260] RBP: 00007f1106c581d0 R08: 0000000000000000 R09: 0000000000000000 [ 1880.522347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1880.523428] R13: 00007ffed1307b2f R14: 00007f1106c58300 R15: 0000000000022000 [ 1880.524564] 18:14:07 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x40000000, &(0x7f0000000000)) signalfd4(0xffffffffffffffff, &(0x7f00000000c0)={[0x40]}, 0x8, 0x800) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) 18:14:07 executing program 2: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:14:07 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x8000, @fixed, 0x0, 0x1}, 0xe) 18:14:07 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(r1, &(0x7f0000ffa000/0x1000)=nil, 0x7000) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ffb000/0x1000)=nil, 0x3) madvise(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x3) write(r0, &(0x7f0000000000)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r2 = shmget(0x2, 0x1000, 0x2, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) r3 = shmget$private(0x0, 0x1000, 0x1000, &(0x7f0000ffc000/0x1000)=nil) io_setup(0xd29, &(0x7f0000000780)=0x0) r5 = memfd_create(&(0x7f0000000100)='/d\xb5>\xbb\xb3~\xa9\xa4O{\xc3\xad \xeb\xee\xeed\xf4\xaf\xf8\x81\xea|f\x1c\xe0\xc1\xd1\x19cr\xa1\x01\xc3g\x10#\xa1\xfa\xb2\xe7\xa4+\x9e\xd7\xa2\x04y\xc1\xcf-V\xc0\x18L\xce\xe2I\x19:\xe7\xc6F\x1a\x16!\x00\x9c*\x03\x1f\x94#\xf1\xcb\xc9\xf1\x16I\x85\xc8x\xe0\xc7\xc7z\xfa\t\x85\t\xfcM\b\x81\xd9d\xe25i\xe7\xb4M\xd1\xa4\xef\x0eW\x7f\x13\xa9>\xcf;+-\xf1gT\xd0\xcck\xb1Nq\xe2\x06\xdf\xc2\x01\x00\x00\x00\x00\x00\x00\x00\xe4\x9b\xab\xf7E\x1c\xb2,\xe4[|\xcc\x85{\xb3\x98\x139\xc4F\x9fE\xa7*\xed\x9b@\x8bH\xe5\xb5\xa7\xae\x11\xa7N\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3Ef\x88fM\xc3\xd7\xb2\aa\xe5?{\x18}\x9b\x87\x83^\xd5 a& \xd9\xa5\xa2\x85P\xdc\x8bO\xcbi\x1d-\x0e\xd9\xd5\xb1\x8d\x81da\xf89\xc4\xaa\x81\xad\xda\xef\x860\x19\xc4\xb3\vW\x19\xae:\a\x89\xb2\x87\xf0\x8ch\xc7r\xf6K\x96\x7f\x15?\xdb\x95\x82\xe8\x10\xa7qX\x8b\xc2 \xb0\xe5(\x87\xfd_\\\x17Y\xf6\vc\xa1JG\xc2\x88\xbc\xb1\xf3\"\x1a~t\xed\xed?\xad&\x11\x06\xc6!n\xb4\xf8\"W&\xf9|\xc9\xed\xde\xd6\xac\xd9\xea\xe6\xff\xf9\xeb\xa8\xd1\xb5\xf6N\xac\v\x88\xfcH\xd2\xe5UL\xfd\xd1gD\x99\x89M\xfbpe]A\x90\x81\xcb\x136;;\x9e\x0f\xa7\x92\xe3\x19O\n\xae{\x17\xa2\xec\x00\x9b/\xff\x02)z\x04\xb5\xf7\xafU\xa2D\"@j\x19\xa0D\x87Dc\n\x92', 0x0) io_submit(r4, 0x1, &(0x7f0000000040)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r5, 0x0}]) shmctl$SHM_STAT(r3, 0xd, &(0x7f0000000040)=""/180) [ 1880.665488] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:14:07 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x81) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:14:07 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:14:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 2) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:07 executing program 2: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 1880.934173] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1880.936415] FAULT_INJECTION: forcing a failure. [ 1880.936415] name failslab, interval 1, probability 0, space 0, times 1 [ 1880.938006] CPU: 0 PID: 9731 Comm: syz-executor.4 Not tainted 6.2.0-rc1-next-20221226 #1 [ 1880.938987] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1880.939998] Call Trace: [ 1880.940323] [ 1880.940614] dump_stack_lvl+0x8f/0xb7 [ 1880.941103] should_fail_ex.cold+0x5/0xa [ 1880.941601] ? __alloc_skb+0x21a/0x310 [ 1880.942086] should_failslab+0x9/0x20 [ 1880.942563] kmem_cache_alloc_node+0x5d/0x420 [ 1880.943138] __alloc_skb+0x21a/0x310 [ 1880.943619] netlink_dump+0x743/0x1070 [ 1880.944113] ? __pfx_netlink_dump+0x10/0x10 [ 1880.944651] ? trace_rcu_dyntick+0x1a7/0x250 [ 1880.945230] ? kfree_skbmem+0xef/0x1b0 [ 1880.945724] ? kmem_cache_free+0xfb/0x610 [ 1880.946151] ? kfree_skbmem+0xef/0x1b0 [ 1880.946638] netlink_recvmsg+0xb32/0xd60 [ 1880.947140] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1880.947626] ? lock_is_held_type+0xdb/0x130 [ 1880.948154] ? security_socket_recvmsg+0x99/0xc0 [ 1880.948759] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1880.949334] sock_recvmsg+0x14d/0x190 [ 1880.949839] ____sys_recvmsg+0x210/0x5c0 [ 1880.950369] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1880.950849] ? copy_msghdr_from_user+0xfc/0x150 [ 1880.951434] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1880.952085] ? find_held_lock+0x2c/0x110 [ 1880.952611] ___sys_recvmsg+0xf2/0x190 [ 1880.953109] ? __pfx____sys_recvmsg+0x10/0x10 [ 1880.953674] ? __pfx___fget_files+0x10/0x10 [ 1880.954212] ? lock_acquire+0x32/0xc0 [ 1880.954727] ? __fget_files+0x270/0x450 [ 1880.955246] ? __fget_light+0xe5/0x280 [ 1880.955740] do_recvmmsg+0x25d/0x6e0 [ 1880.956130] ? __pfx_do_recvmmsg+0x10/0x10 [ 1880.956644] ? lock_is_held_type+0xdb/0x130 [ 1880.957193] ? vfs_write+0x492/0xd90 [ 1880.957677] ? __mutex_unlock_slowpath+0x15c/0x5e0 [ 1880.958309] ? syscall_enter_from_user_mode+0x21/0x50 [ 1880.958933] ? lock_is_held_type+0xdb/0x130 [ 1880.959470] __x64_sys_recvmmsg+0x213/0x270 [ 1880.960031] ? trace_rcu_dyntick+0x1a7/0x250 [ 1880.960594] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1880.961193] ? syscall_enter_from_user_mode+0x21/0x50 [ 1880.961840] ? syscall_enter_from_user_mode+0x21/0x50 [ 1880.962371] do_syscall_64+0x3f/0x90 [ 1880.962839] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 1880.963490] RIP: 0033:0x7f11096e2b19 [ 1880.963964] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1880.966123] RSP: 002b:00007f1106c58188 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1880.967022] RAX: ffffffffffffffda RBX: 00007f11097f5f60 RCX: 00007f11096e2b19 [ 1880.967910] RDX: 0000000000000001 RSI: 0000000020004540 RDI: 0000000000000003 [ 1880.968784] RBP: 00007f1106c581d0 R08: 0000000000000000 R09: 0000000000000000 [ 1880.969613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1880.970458] R13: 00007ffed1307b2f R14: 00007f1106c58300 R15: 0000000000022000 [ 1880.971326] 18:14:28 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x64, @none, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @any, 0x0, 0x1}, 0xe) r1 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x38b, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000080)={{r2}, 0x81}) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000040)={'team_slave_1\x00', {0x2, 0x0, @multicast2}}) 18:14:28 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:28 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:14:28 executing program 0: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:14:28 executing program 5: clone3(&(0x7f0000000280)={0x114560000, &(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100), {0x1a}, &(0x7f0000000140)=""/135, 0x87, &(0x7f0000001040)=""/4096, &(0x7f0000000200)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x5}, 0x58) kcmp(r0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_open_dev$sg(&(0x7f0000001000), 0xffffffffffffffff, 0x2) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x7, 0x0, 0x80000000, 0x2, 0xf0d0}) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x101) 18:14:28 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = dup2(r0, r0) r2 = gettid() setpriority(0x2a773a1eb211ff6d, r2, 0xfffffffffffffffb) signalfd(r0, &(0x7f0000000000)={[0x1ff]}, 0x8) fcntl$getownex(r0, 0x10, &(0x7f00000002c0)={0x0, 0x0}) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r4, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30c) clone3(&(0x7f0000000340)={0x180, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200), {0xd}, &(0x7f0000000280)=""/58, 0x3a, &(0x7f0000001040)=""/4096, &(0x7f0000000300)=[0xffffffffffffffff, r2, r3, r2], 0x4, {r4}}, 0x58) open_tree(r1, &(0x7f0000000040)='./file0\x00', 0x1) r5 = gettid() setpriority(0x1, r5, 0x0) rt_sigqueueinfo(r5, 0x7, &(0x7f0000000100)={0x13, 0x9, 0x5}) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={'\x00', 0xfffe, 0x1000d4de, 0x1fc0000, 0x5, 0x9, r2}) gettid() write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:14:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 3) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:28 executing program 2: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:14:28 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) pidfd_getfd(r1, 0xffffffffffffffff, 0x0) [ 1902.261731] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:14:29 executing program 7: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r0 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0xf1a, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r0}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) syz_io_uring_setup(0xe84, &(0x7f0000000100)={0x0, 0xcd04, 0x8, 0x3, 0x3bf, 0x0, r0}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sync_file_range(r0, 0x7e2, 0x2abf136a, 0x1) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000040)=[@sack_perm, @sack_perm, @sack_perm], 0x3) 18:14:29 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) preadv(r1, &(0x7f0000000200)=[{&(0x7f0000000000)=""/216, 0xd8}, {&(0x7f0000000100)=""/221, 0xdd}, {&(0x7f0000000280)=""/222, 0xde}], 0x3, 0x7f, 0x2) 18:14:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 4) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:29 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCGARP(r0, 0xc0189436, &(0x7f0000007080)={{0x2, 0x0, @empty}, {0x0, @link_local}, 0x0, {0x2, 0x4e22, @remote}, 'syz_tun\x00'}) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000000)={0x0, "5754bb2a57322840e0342c6affa0ce0a"}) 18:14:29 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x600202, 0x0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x10001) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xff}, 0x0, 0x1}, 0xe) 18:14:29 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r1 = openat(r0, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1, 0x7fffffc, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1}, './file1/file0\x00'}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) accept4(r3, &(0x7f00000006c0)=@can={0x1d, 0x0}, &(0x7f0000000740)=0x80, 0x80000) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0), 0x0, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) sendmsg$inet(r2, &(0x7f0000000840)={&(0x7f0000000280)={0x2, 0x5e21, @rand_addr=0x64010100}, 0x10, &(0x7f00000002c0), 0x0, &(0x7f0000000780)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0xd1}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @local, @remote}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfffffff7}}, @ip_ttl={{0x14, 0x0, 0x2, 0xffff1419}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @rand_addr=0x64010101, @private=0xa010100}}}], 0x88}, 0x24000081) setsockopt$inet_int(r3, 0x0, 0x12, 0x0, 0x3) fcntl$setstatus(r3, 0x4, 0x4000) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) pwritev(r7, &(0x7f0000000080)=[{&(0x7f0000000140)='\x00', 0x1a}], 0x1, 0x7fffffc, 0x0) openat(r7, &(0x7f00000001c0)='./file1/file0\x00', 0x2, 0x4) recvfrom(r7, &(0x7f0000000180)=""/213, 0xd5, 0x2040, &(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x25dfdbfc, 0x2000}, 0x80) close(r2) sendfile(r0, r0, 0x0, 0x100000) 18:14:29 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 1902.521864] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:14:47 executing program 0: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:14:47 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:47 executing program 5: r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000080)=0x1c, 0x80800) signalfd(r0, &(0x7f0000000100)={[0x38f2]}, 0x8) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000001040)={'security\x00', 0x1000, "0b01f8b01af0135a421bb238e7da4a7e96b7477050fdd6e1bfe852864584eb94cbb645bcfa7d9addbacf6c6a9f45716ce7af7d0ba410aabc7dd1108484e985044b92dbbf50fc754dc8e883413fb79a6b00ac951dcb4a78f9603d6498187f5470d1aef96fb298232986c5c0fc87acd88edd26c1879c7fc4b464f5181b0b0a31e3d8b63ef8cd967038a8dd8f67db1af0bcd3aeb25961ffa444da907221486f0381ccaa8e3b2a09a001bda7fdb9a06a71e47d84bfdee0f9110a86b2a2e932bd63895e6e8a898f9cbe3aa7bf5b2aa2f3c17b66800b01d818b0cc58e0911943daf4809234f8802c3c2a08000b7d63932a2955d51e0d9abedc186f7210644141c207d2bccf6136942e04cfa17be25049293edb520020b23c40994f3dff831a08dff7ad3e455f4ca636b1f0be12e3bd6d22b31ee9d950c79dc588bd822f840967e4234d52256d779e4f4f5033ce85bde45de12ebafb3c02bc50612a7bdbd6083c00f1b531b78f022a81d35a654ac2e462b8aea50a93b13c8a568e20acb53fa196a8fdbb7389edfada3af72d66193310359530fc35948cec4479b76f09b4328f22ba828782abfae65533c076d3a91a5ff231494849bbe83e15d3ff7e0d672e12fd4db7e6e3b28f001033d8397b5aa338b08cf58e8363be28143fb0d5610ab0b47b20d257ae97033eba8aed3f620284beb625a8bc77bc935f58133922d2a8a3f81ccf5a56de3a4245eef55e84f4200e7358514df41db00154076e07fd4d7f67032f919287566a5db30b85312fd46db4de0518a8cbd9af8bf331561c4c51abc8741afc7795d6300998221950b5c27c11fbfb97ec571f904bb12a27c6312ef0277f4b5f83ec30b2ab56f3cfaaa3462e13bee3867f876c7828df0001639243b8d108684d4c7a5c4f4fabb9253348f01820dfe70714e46bf195910a84f775fe769db8f9bb997c8f1053dde8b9c780588df57246bc26823418c8c531cd2c21b3374133de47a11bf7422a9bd739fc8544cd64b6bfd6dc950da53a2c7fd4e73c2f9375af43e16fcd44c15b8bbf847759b3f0718bce6bdda50660f0653d5fcfc8cfd524cc2eb9a7746705f7bd69f814f6cad06143638eb4d7db9e18223f0000e436970a4130bbdbac63a83991f1c5a9aebda9a90af6f10cf807616c35ccbb518a106587f8b9fa993affd130b7305c5e1d57ce0f5b9e43524db3e4cac8743a89c3c626be52be0369a92680c6e0e02ef768ad114171a88a3ad5ed5165e8978c1fe8a3c9491c9dda33beccccc4cf16b1f122a426753e2a1c6c3654ac17ed7142e2b578752287c40a54660ad86834e15ad52a4483348115dbe95478cb130f2d4ae4435b2f9631723771573ac31af2470428916c761ca3ec8dedabafa87eb5f16659a83b846ffa5ebc924f1efa9f146677024d5563a4ab4473dea562d1aea00576f4810de580944651f3605000474599fed5a271ea3417fd7702f13050440d906877225ef8e35f911a75978a6a9f2956183a7b3fdacfbacd26495e0f22d04ed1a29b0ab86d5d242ac848ba900ba026c0b9fbb38d94243d1e61b711f6923188cb697f31c5fac72c2af8993187f52ab9bdd2bf7de4d49a16a40bf8875a28d5ce4fe72c44e7141570023b1191404a04716dc9bcf35658a84f3446a50d6d58bff62532fd43ce6c9a903aa1b142665d453a06c2f8a43289701d1fb16273f7568a935ba88b041b6b0380e199c71a06242206dfd8ee2a726eed7ab7f2bfdecf62a31af4ab976b4a3d7e84f0380749fbff5338da25af4ac05b64560172a1fd40b48caa995ded00c4f31b9e67def06db6b5ae975accf74d0e0357c6506cd4277818c67913c51f89dab21e125f9f92f9345bec1b468deebbf0c2aea2356daf833dc5961ffe3d54690eb589129c3df48e1f6bae90d349fb4efb2af92c90076e4f1b8071dd858f82cb88b16152f7c6d61e16ee509b81e05f4902273e2abbded074cfa01869babdb7f614ee16cad17fb75c2f93bac694f896eaed911e0b620e3419f2ac80d12cbf53cc58dd506249ce80a5de9e10ef5284505411ddc839d38dee64273125b9748f85becbf1dc2e21895a88f4be376bc2531039165cddab0a1b6fb56b6c0cb993fec191f4bb8a8b55ebb08baa9331b9cce5cd3b92c07ba8a15d6e5cf613ecc57bbdda27bfe3e3286156d9abd6a9e86d046f883184f975317950326838c9c5dce13e10527ca535cafec2c30eeb920b0d7e3b578b00f7560aa04c4b42a1b310dd81a03529405fbc0d5fc7bcce7ddcdafc96008baaccb261cd867ae3565fce0bb407c7ca09347bbe3f7d8367bf4f63c60adb5b32f4b6bcc85ecaf9b8076f5bfbe103f802bd41e587cf4530765bdf6ec96e82f538f6d0e4a8e3f11bddc67e00e18b682f024e574ab649d4aac9c42592d3408b2872e1617c1b6fc401df77381026db59d1b6154fd80af2316dbe765a51ebe28c340d69936507803a1910b4b1c98c8653ef98f84d2bcddfe71cacb00070dd7a824ff218e99d0bbfd1fbf81ee36a8a57ecc9289ba82d50b64a529fd5b93b4df38773620db1300102d9c3c9d001613c44169074a39d877956ca416b398c5acfa5b5cf6982c06a1fecbcbda092708eadffb915a6a1c97e7b4643a7964741f5ebeb0330eaf684a4b6be7f00c5fd830a87745a8401509ee850c8ac76e7990c0d656580fe14d90d8b420eab51abdfd715ddd9d0fbe50da6d4cf27fe5df2ec625b76426ef1b4f280f088bc3cf4b3b420758ec7acd75f47ac59f74421e5a9fd322d91b4d5637efe795076465042f9e545967058d00df4fb92c2cf12359a1ff66688aba7bcb81ab93d8e03c5d102e28e1773bba6a0432a2258a930d900f17540486c90207ee9d9858a6c372fee1c369f5c80410a39d61c4af53aff558d52a0d7bcf45adcdb3c1e3a797166244439b7c706dff5c2830d322dfe8d5f228c344cbe8f38ccff9827c98aff7a3384723af6d7a5981462a476615d3e4bf574d86d494b26a14879e58751396145271da3b1038c5a2dba67a9dd58aad968cd181459ab9ba66b788be3e2b585491319c919dede1f62d1ea46a49050917f425641d06f5f9672e3235b152886e504fddf6f74499f949f7339f8e2a31af4523cfde784f9c33190fb7225c838812bf90d277ebe043b08cb3de1987c9f6db2793790f4cab80149480ca14cb40201aab85b21990beda28f516269aea0be765c9ec45e48f6485ec1fde1e13d9bd93afa07008d21f4ddb8f4412af8f850813830d040b50bdab8e15c3230c1cc33acb77ec710a9c3566dc9d8e8e2cfb3ae92526e138464989202b01218f2c181f69077c593060e993c9de9fe881bbe20ee301f17b6cc5a1ba11feaf747831397b2968f4afb490ac66fd18b2db5b1f835430e22fa66b2fb726f4387bdc8a82042da0beb09dada6ba7dcde2aadfde2b08e1c5885530dc36ae30b84186b7a32779f160d1311fb9e2f13ff7102d02520e3dc71bcca4f64804422170a91e0898b5f3c29cc9a9f9909fb7de84af6463b186fcca9c98820144ad5d3f5a59d481631a3629791797a3dbb463b457598d95f26e571479910a87f87821ff6feda04eac8a4d7a054b1f64d27819a3da9fc7e378ba88e14fa20e654fe45af079edbea22d2decd5cce7fb1814787064ed39d26f2a28891da27a74a409622df5e76633060938a8b6cc94b8ffc1649359a7490c785d39862c421b3cf6fc4df0e8ab2dd316a183c3d09c7b6a983edfc4838d8bf4777898e4d6ecfe18485fb9f981810a84721108dd47161499c6bccd63fac270a8e9cbd6ba3500d39e99739fdf7db299cb9e5c9e248b5e6e285cd4148dd1d015bbe048e951b16776b515df013078048bc29716e9ac963c2f52c948c9de8d41b97eb0e44f2081a8176730766210fd793e69cb2b4a352ae5e4fd2332d14eeb2d4c5001a007847f3e722f8bd94fc17aaa50c0bbd8281fb9ace7e14a55ef7f7699592797723c0867bbb4804334b0f059400da8d79aab071c696261af37b7d03b343a7a727036a5b6dc980f8e9123b51be501de63394ef3c94dcd25fa5622f2ecc0005b492ca422a4ae326ea545a5f3f7ef8368da86610333bfe1bbad0fde6d4eb43a61e5b63108cbe42f886ea38f9d6001934f1773856c1fa264ea8952fbff505e2e8912af1c33c67c4cf5d20d06468425c3923805e3e6134c7d3cdf0a5d23994c42725d5a4ead079d5fd9851275ce9fc08f8a341172648b1a5c2669b68b783d80b7572da6aa3ddd886bd5bde90fe0d2c5bd85f942e87cd14058b514e730dfded0141e37f6342c0aa34b15c969e111f73ca3f403391a08e5406f91e97eca7fc88ac75322ca15ff3b8641de394e9810e01fa751c05d760e953155be10d2ec9f74f8a4716a5e977593a4eb63a64c94f72a9518bbdd8cb6602ece644beb42f4d80c7572a7c0c180636d6a48451e72882262da605f07d37a2e27efcda7311d5f59ce97a776e1951f5252e5be56fb815aced72c72dc9f13a306d5b3ef47acd713e47aa9e402694ffca30e9a2708f3fb80e1d6c69124924b57d3005b254cc746a05ffddd323bef618c00282e7974291cfb35deb71f6923d11e2f4972f7f81864e7094c1bc4f702dd0659418922a47623a00cf9381539682683f143f22232928b5d0aa3436ea751cffd2d7db4def238a4c6ae8278aba27ad61acf8a78db97f9dde7b2f21cf8943cfc8acb606c058560eaaf3274444d5e7a0c66bc3b5ad91b26f32d2552998e68361f8df7a6bca8963482e3ea08b3626f9cb493c25b88921ea6878b802466f52a5be51125ae90fde0152b146f826d463e8fe8e14a00455b82ab0de20ebbbbf207d143dbe1e9ec7000ebe21db899dc407f118c9c2bbbb5575d8eb36186030196f55cd5c959d37dc36de8c09c2fd98c78473bb833c5e0cbb0216f16fe7da1e721ea51466dfc7132b9ca827d3aa84f71361cb25074cfc019ea2673f78a49fa1929052f54e9ea1368fb669ba7f2471aef6adc6a983925fba663bbf77213006b27c127d8846a4a6d80f7f44f98c1e13076d5a6ad35b61079fae1bdfc85d85fead4eb090cb973125cea4260ba7fac878371973ca5af5105e5cc926f3bec52ecc32bab6b05143a4434a73096f436e3ffeb102f87ab2e8c6f47ff71bd8d6552c2ca1cc19a65c0e09e75a6ae5b78879972ccc85af85365fdf6760e32d75eef9adcea59b068f895e81cc0522384d1431ed21e631dc265474271133f9a90e3c87182b13e4daacda8f23fc0a728fdaa23aa8c2b2bbd74720335e82837b9aeb0dda8a8a55c243918cc1ba1203910de93f7395148124629bddb6495ec4ee9fae7e1c7093fe6f827a1c1a2c7b58e60e5b7cec651767ce5b828c26bbfadf2b0a83dbf8c7ce0fee1c42c674b47b012bf57a77853e9c70c5c637320576aa592ddcf3aeff8bfbe62a2b5083945de4ef36f0adaf7cbb7170a4e1eda2ae8bc9544d26ad59178f8a34868aa09bc08928f08610882dbf95c24e855039189158e4666d9c3125141973359b77147a85c0a1426f1aa624403e53b65cf3c6070806b07413e9839604a9b8fb55c87e4ee315e627b93a3c20e221f1137b82a756f421377a96d5a87fe68716baccb53d1e34ee93dbbd5df23d7b28a3613adea5f516b5db852b5cf8525a3cee3204619598338d4891627ded9c53d2b05eb8aa421fa062bf68bbbbbdc85f5f51d4a2a176d99bd4e826c5fc5ecf59a60d5706619a44ded5e8d0cebff991954c9630d62428de22c3f2d61609968d9df65f959362d8c602d2c1370342e7e95e605d0e8e6bda9e12cd8ad6f6d503c65983830f47f650"}, &(0x7f00000000c0)=0x1024) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f0000000000)) 18:14:47 executing program 1: syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x21, @any, 0x0, 0x1}, 0xe) 18:14:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 5) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:47 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = open(&(0x7f0000000040)='./file0\x00', 0x90000, 0x120) ioctl$BTRFS_IOC_LOGICAL_INO(r1, 0xc0389424, &(0x7f00000000c0)={0x7, 0x20, '\x00', 0x1, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0]}) r2 = socket(0x15, 0x5, 0x1) sendfile(r2, r0, &(0x7f0000000000), 0xfff) 18:14:47 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:14:47 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:14:47 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) flock(r0, 0x8) 18:14:47 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 1920.738026] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:14:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 6) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:14:47 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) dup2(r0, r0) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:14:47 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @none, 0x0, 0x1}, 0xe) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000140)={0x400, 0xfe, 0x3f, 0x6, 0x0, 0x3, 0x9}, 0xc) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x8, &(0x7f0000000040)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) [ 1920.896779] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1920.897721] FAULT_INJECTION: forcing a failure. [ 1920.897721] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1920.898571] CPU: 0 PID: 9826 Comm: syz-executor.4 Not tainted 6.2.0-rc1-next-20221226 #1 [ 1920.899256] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1920.899832] Call Trace: [ 1920.900040] [ 1920.900212] dump_stack_lvl+0x8f/0xb7 [ 1920.900514] should_fail_ex.cold+0x5/0xa [ 1920.900824] _copy_to_user+0x2e/0x150 [ 1920.901116] simple_read_from_buffer+0xd0/0x170 [ 1920.901471] proc_fail_nth_read+0x19c/0x230 [ 1920.901793] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1920.902151] ? security_file_permission+0xb5/0xe0 [ 1920.902586] vfs_read+0x257/0x940 [ 1920.902855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1920.903212] ? __pfx_vfs_read+0x10/0x10 [ 1920.903503] ? __fget_files+0x270/0x450 [ 1920.903817] ksys_read+0x12b/0x260 [ 1920.904095] ? __pfx_ksys_read+0x10/0x10 [ 1920.904402] ? syscall_enter_from_user_mode+0x21/0x50 [ 1920.904778] ? syscall_enter_from_user_mode+0x21/0x50 [ 1920.905163] do_syscall_64+0x3f/0x90 [ 1920.905453] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 1920.905849] RIP: 0033:0x7f110969569c [ 1920.906119] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1920.907401] RSP: 002b:00007f1106c58170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1920.907913] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f110969569c [ 1920.908410] RDX: 000000000000000f RSI: 00007f1106c581e0 RDI: 0000000000000004 [ 1920.908910] RBP: 00007f1106c581d0 R08: 0000000000000000 R09: 0000000000000000 [ 1920.909398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1920.909901] R13: 00007ffed1307b2f R14: 00007f1106c58300 R15: 0000000000022000 [ 1920.910432] ioctl$BTRFS_IOC_SPACE_INFO(r1, 0xc0109414, &(0x7f0000006880)=ANY=[@ANYBLOB="1104000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000039385c2af53a8e406538023ba9750000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db54358fb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e994c3c2551790aa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000077d4adad3adb28c2c0454f3f742bc14bb6db7867836ef97fa1887ff295fda6e9165d44d63420e18e539fefbfb954e93f3d999eceb46b65ea7e78212f83c508c9b69177b5de9fe88996cb5de2c80be90598ce3d7e1844da59f99998f50b12f354eee5b491d13f14b1db7a8a2cf9d5f3b61865b3236357f3d96b28a58721162174f42449330df876c4979276623025f458ba9c7c8c75dfa82d88d6e9ccafb36f493123edcf16954dc528422ee8ed234e2180ca68900b71bbf435dc5a64c52fc5fdc4db63d02bf104ee10eac41542f38cbd01790d675e"]) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x65, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x0, 0x3}, 0xe) 18:14:47 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:15:04 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:15:04 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0xc302) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:15:04 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x40000000, 0x48040) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:15:04 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:15:04 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) creat(&(0x7f0000000000)='./file0\x00', 0x184) 18:15:04 executing program 0: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:15:04 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:15:04 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:15:04 executing program 7: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_ASYNC_CANCEL={0xe, 0x3, 0x0, 0x0, 0x0, 0x12345}, 0x7fffffff) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x7, 0xa0182) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000340)) write(r0, &(0x7f0000000240)="32999a17616c822a066768c86e4b4f757dd33c8b98c402e400003fea2beb5635bdf3616c5487978d4546919d00009e00", 0x30) r1 = fsmount(0xffffffffffffffff, 0x1, 0x2) r2 = gettid() setpriority(0x1, r2, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000380)={'\x00', 0x0, 0x5, 0xbdb2, 0x0, 0xff, r2}) ioctl$SG_IO(r0, 0x2285, &(0x7f00000002c0)={0x53, 0xffffffffffffffff, 0x24, 0x0, @scatter={0x1, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/39, 0x27}]}, &(0x7f0000000100)="a83dc0e3b237e77508f0a49a697813244c464495ef24ae098948f6bc61964add29fe7e45", &(0x7f0000000140)=""/193, 0x8722, 0x0, 0x1, &(0x7f0000000280)}) 18:15:04 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) r2 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0), 0x0, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @remote, @broadcast}}}], 0x20}, 0x0) sendmsg$ETHTOOL_MSG_WOL_GET(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xe8, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x74, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4001}, 0x0) [ 1937.393915] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:15:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:15:24 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='/dev/sg#\x00', &(0x7f0000000040)='/dev/sg#\x00', 0x0) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:15:24 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:15:24 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:15:24 executing program 7: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f0000000040)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b0544a695f86deb5635bdf3616c540500000000000000bd9e", 0x93) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0xee00, 0xee00}}, './file0\x00'}) 18:15:24 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @none, 0x0, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x800, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x38, 0x2}, 0xe) close(r0) 18:15:24 executing program 0: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:15:24 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:15:25 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 1958.344764] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:15:25 executing program 0: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:15:25 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0x80402, 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x40000000, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x20000000, &(0x7f0000000180)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) flock(r1, 0x2) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x3, @none, 0xff}, 0xe) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000280)={'bond_slave_0\x00'}) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/selinux', 0x40, 0x8) bind$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @any, 0x6, 0x1}, 0xe) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r4, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30c) r5 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r5}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) fsconfig$FSCONFIG_SET_FD(r4, 0x5, &(0x7f00000000c0)='\x00', 0x0, r5) bind$bt_l2cap(r4, &(0x7f0000000140)={0x1f, 0x679f, @none, 0x9, 0x1}, 0xe) 18:15:25 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) close_range(r1, r0, 0x2) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) write(r2, &(0x7f0000000000)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:15:42 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:15:42 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:15:42 executing program 0: ioctl$EXT4_IOC_CHECKPOINT(0xffffffffffffffff, 0x4004662b, &(0x7f0000000100)) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000140)}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmctl$SHM_STAT(0xffffffffffffffff, 0xd, &(0x7f0000000380)=""/9) shmat(0x0, &(0x7f0000ff6000/0x1000)=nil, 0x0) ioctl$EXT4_IOC_CHECKPOINT(0xffffffffffffffff, 0x4004662b, &(0x7f0000000040)) shmat(0xffffffffffffffff, &(0x7f0000ff2000/0xe000)=nil, 0x5000) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000240), 0x5}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000300)=""/69) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, &(0x7f0000000000)=0x35, 0x1000, 0x1) r2 = fcntl$dupfd(r1, 0x406, r0) r3 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) shmget(0x0, 0x3000, 0x800, &(0x7f0000ffa000/0x3000)=nil) 18:15:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x2, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:15:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000340)={0x53, 0xfffffffffffffffb, 0xfffffffffffffff1, 0x8, @scatter={0x2, 0x0, &(0x7f0000000280)=[{&(0x7f0000000100)=""/189, 0xbd}, {&(0x7f00000001c0)=""/75, 0x4b}]}, &(0x7f00000002c0)="dcc41a001ecf4c8467733b84a562918c4694692ce5c5a08e8bde59509cce2586ce771897e5855c1c66b87d08f210520b669cdb4bb35c04f493306946343d", &(0x7f0000001040)=""/4096, 0x8, 0x20, 0x1, &(0x7f0000000300)}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0), 0x0, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @remote, @broadcast}}}], 0x20}, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="040027000800040000220100"/25, @ANYRES32=r2, @ANYBLOB="0c0003000400000000000000"], 0x40}, 0x1, 0x0, 0x0, 0x4c014}, 0x810) 18:15:42 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:15:42 executing program 7: syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x102) 18:15:42 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @none, 0x40}, 0xe) 18:15:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x280402) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:15:42 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 1976.210440] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:15:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000080)="32999a17616cc86e4b4f7578d33c8b98c47edb00a4ceea2b05448e95f86deb0d2577da8c8487471ebb655495d70e5635bdf3666c5487978d4546919db903e0f4cba7f8f0d77664d942f6146fbbf17ae6931b78b3cb55074c57366f05103ec4eb4dfbfb2cbb5dcd21d1dde38ff826c2a44542f9aff33a8c8f53881fa52d9eba6eef586cca823506ace3467a4fc9a7527f8d10bff418ce77468eee71133637f04c589649c462e8a12b9aba1fdc4e104686ca72dc7b94673c85ae87b8aeb1516c4523d07435a2908f46077945f8fc538b665f180ff840a1401277bb8ec7862ecc200bf9c2ee2d8e", 0xe6) 18:15:43 executing program 1: syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0xfffe, 0x1}, 0xe) [ 1976.277607] sg_write: data in/out 1858628669/178 bytes for SCSI command 0x84-- guessing data in; [ 1976.277607] program syz-executor.5 not setting count and/or reply_len properly 18:15:43 executing program 0: ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, &(0x7f0000000240)=0x5) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0xcfeb, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000), 0x4) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000200)={r0, 0x1000b58a, 0x100000001, 0x2}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0xfffffffc) socket$unix(0x1, 0x5, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x7fffffe, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5f1) setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000001c0)=0x2, 0x4) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x87ffffc) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x181c00, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000180)={0x0, 0x2, r0, 0x6}) 18:15:43 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a17616cc86e4b4f757dd33c8b90c47edb00a43fea2b05448e950200eb5635bdf3616c5487978d4546919d06bd9e7f503e585c54472801922b96e52ecd10082e54f5dff971356ad58fb7f259d53e66efe9ef728d93ae24ca1577040000004f51776fc166de8df0193c610a9666a190", 0x41) 18:15:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x3, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:15:43 executing program 7: syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), 0xffffffffffffffff) r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat2(r1, &(0x7f0000001100)='./file0\x00', &(0x7f0000001140)={0x200080, 0x20}, 0x18) r4 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r4}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000380), &(0x7f0000002180)) r5 = syz_io_uring_setup(0x53ab, &(0x7f0000001fc0)={0x0, 0xa511, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r5}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r6, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r6, 0x400454cd, 0x30c) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000012c0)={&(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0x2212}, 0xc, &(0x7f0000000200)=[{&(0x7f0000000180)={0x48, 0x23, 0x2, 0x70bd27, 0x25dfdbff, "", [@typed={0x8, 0x75, 0x0, 0x0, @uid=0xffffffffffffffff}, @nested={0xc, 0x84, 0x0, 0x1, [@typed={0x8, 0x2d, 0x0, 0x0, @fd}]}, @typed={0x8, 0x40, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0x14, 0x8a, 0x0, 0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x17}}, @typed={0x8, 0x6d, 0x0, 0x0, @u32=0x45d4}]}, 0x48}, {&(0x7f0000000280)={0xd0, 0x11, 0x300, 0x70bd27, 0x25dfdbfb, "", [@nested={0xc0, 0xf, 0x0, 0x1, [@typed={0x8, 0x39, 0x0, 0x0, @ipv4=@multicast2}, @typed={0x5, 0x6a, 0x0, 0x0, @str='\x00'}, @typed={0x8, 0x18, 0x0, 0x0, @fd=r0}, @generic="c2e45689499d0deffda02e5cb61e2e644a969917f7e55de229480d805e38556e8049556be9083092745b192ce6f851cc817382202cada84dd712569bc0d5508404a34b3412e4750eba1ccc9c740e02f340df8c9e3735a5d32e19f4da07b31f25ab1cd17eeb68446de408e6db2a", @typed={0x8, 0x44, 0x0, 0x0, @uid}, @typed={0x8, 0x58, 0x0, 0x0, @ipv4=@multicast2}, @typed={0x8, 0x11, 0x0, 0x0, @pid}, @typed={0x8, 0x55, 0x0, 0x0, @u32=0x7fff}, @generic="f0d7c410df5fb02c091806d68069ef7cacb6af2e9ed70f"]}]}, 0xd0}], 0x2, &(0x7f0000001180)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xffffffffffffffff}}}, @rights={{0x28, 0x1, 0x1, [r1, 0xffffffffffffffff, 0xffffffffffffffff, r1, 0xffffffffffffffff, r0]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r1, r2, r3, r1, r1, r0, r0, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [r4, r5, r0]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @rights={{0x34, 0x1, 0x1, [r0, r1, r0, r1, r1, r6, r1, r1, r0]}}], 0x118, 0x24000810}, 0x40040c0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000040)=ANY=[@ANYBLOB="f500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000"/249]) [ 1976.386713] sg_write: data in/out 1858628669/17 bytes for SCSI command 0x6c-- guessing data in; [ 1976.386713] program syz-executor.5 not setting count and/or reply_len properly [ 1976.462974] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:15:43 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:16:02 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x4, @none, 0x0, 0x1}, 0xe) 18:16:02 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000280)={0xb9, 0x7, 0x6, 0x1, 0xa, [{0xff, 0x9, 0x401, '\x00', 0x3901}, {0x200, 0x7f, 0x10001}, {0x159, 0x7, 0x8, '\x00', 0x2408}, {0xfeaa, 0x7, 0x7, '\x00', 0x209}, {0x9, 0x1, 0x1, '\x00', 0x48a}, {0x6e55, 0x400, 0x3, '\x00', 0x85}, {0x2, 0x0, 0x7, '\x00', 0x1006}, {0x8, 0x5, 0x8, '\x00', 0x80}, {0x1, 0x9, 0xff, '\x00', 0x800}, {0x41e70420, 0x5, 0x30ec}]}) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:02 executing program 0: ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, &(0x7f0000000240)=0x5) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0xcfeb, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000), 0x4) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000200)={r0, 0x1000b58a, 0x100000001, 0x2}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0xfffffffc) socket$unix(0x1, 0x5, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x7fffffe, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5f1) setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000001c0)=0x2, 0x4) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x87ffffc) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x181c00, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000180)={0x0, 0x2, r0, 0x6}) 18:16:02 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:02 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:02 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:16:02 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a54742944e7ba4f17526cc86e4b4f757dd33c8b98c47e458c6deb5635bdf3616c6387978d4546919d07bd9e", 0x2e) r1 = syz_io_uring_setup(0x3e1, &(0x7f0000000140)={0x0, 0x2ba9, 0x10, 0x2, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000000100)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) fsopen(&(0x7f0000000080)='erofs\x00', 0x1) r2 = open_tree(r1, &(0x7f00000000c0)='./file0\x00', 0x88000) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) ioctl$AUTOFS_IOC_FAIL(r3, 0x9361, 0x4) 18:16:02 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x4, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:03 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:03 executing program 1: syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) setsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000040)={0x5, '}|?'}, 0x6) 18:16:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0xe3, 0xf915, 0x800, "9cc21d9b40fabcbfd2cbd530a1bd81d028a5e08fcf7ebd1cf00b1f3a312068879a331732ff9e271fa0546eae63f44984a8c1133c3af99eee74bf3c1c9fbd23c88c058a1708bd3be809dc73566f9a58a68f9f74b5757c9b9e772e9fa2f823a6ce04b4acc722911480c363ab7c075135ca4df762a2813a54aa0dc85a707da92eb22c1e4c3f6c25430dca1f7a9e192012fcb5861a806ab6652261013a522211c2b00959ae78fb2284a0f89138606257d413197ee222c53d77db05aaa90a20ca7044551276d4e03aef9fce0e52c2cdb308306d44ff09179606df7915f6bce2d0851e033c53"}) [ 1996.374260] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:16:03 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ppoll(&(0x7f0000000000)=[{r0, 0x420}, {r1, 0x8}], 0x2, &(0x7f0000000040)={0x0, 0x3938700}, &(0x7f0000000080)={[0xff]}, 0x8) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) 18:16:03 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 1996.411511] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1996.428778] program syz-executor.5 is using a deprecated SCSI ioctl, please convert it to SG_IO 18:16:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x1, 0x18000) r1 = signalfd(r0, &(0x7f0000000040)={[0xf]}, 0x8) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x5, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:03 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:16:03 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) [ 1996.673872] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:16:19 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:19 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) bind$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x2, @any, 0x401, 0x1}, 0xe) accept4$bt_l2cap(r1, &(0x7f0000000000), &(0x7f0000000040)=0xe, 0x800) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) sendmsg$NFT_MSG_GETGEN(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x10, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x1) 18:16:19 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:19 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:16:19 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0xaa081) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x5}}, './file0\x00'}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x4000000c}) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x6, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:19 executing program 5: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r0 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000040)) write(r0, &(0x7f0000000000)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x1d) 18:16:19 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x2, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:20 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$BTRFS_IOC_FS_INFO(r1, 0x8400941f, &(0x7f0000000280)) [ 2013.307549] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 18:16:20 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000)={0xd900, 0x6, 0x8, 0x1, 0x25, 0x1f, 0x2}, 0xc) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000000140)={{r1}, "5b1ff23c1f6f0bc9159e3d9ac5244aff582190ab292b24ffac17393dc733991f8d57a45e07a772ae6a11948768fc3a82077ee8a9eda26b8683d1a491d9d8db3accd64ebef7b7f74182abd3a9cd4c3c918af633819535f7029dcd792fb1460d52bc2e423c89746785b36bb5c9aaf1d139a62fdb5848a9cc96344918c59c5629e0e746b8dbbdeaee2ed1699b094a1095f77178aed0cc3c99699a4c3a0787181964cb2d1de01fa7d8be699d2b825249ae7582c41f552c08e06e611cbc0d1d7f9fe296a2995391f26e549873c81e00dbb39804192e4faa7af1c1b07e35b8284dbfacbda9efaf3487f619d30785a847d3785d1d1849bc6952dcfccff45131d96d797acd9547dcb73fcea4d7e042e225b8cd9b704ce47f4bc6341a34992df97bfcbb45aab83b682846cbec9d425c14ce82b305bf278fbe850020bd5e1785609a679d45b642e6ce2e8ed8eff404ef4b7d601dd294345f96b1c1dae9e3bd44b183961f02cdd47e084e1b4624d4f6876b62dab7885dc7e606c3d7a37d3d004b2fbd04c3a304d09ea61386cfa694177415f2c5dd7f11438c5d61de8c0ba063dd70994bfcc0c193fc1fc56453216a5d137f680f20a939af52f74051a57b4c6bd4d8275ba3b751296596a679ef8951c51f1233ece5735abb1e1b65461f2c66b9b8a12703151e2d93025278ddb82baf223940f4b41c5ec19a6f104daee411b1647293aabd9b81406c1ae23131ed64980553e6709bcb71991ed39e001bae88c9ac55c106f6390aea789572eecb42e71da82597da90bf4e0d26116d37e191004412b5f5eb4c63cd0e4f59493e336ec1e7f400051b7e69536c1c9cfb0625b32d61e4a4528bc97379f187717e05bd8aef8720570ad5ce9677245d80a833731af23c0d334e9ffbfa44e00126eeae36850d8ed288b42bf887ca21ec7a8b497e0d537839a84deeceffaa565f028314591f0eb6730daabcd5dd86b7f5149255bd67f1efe48dc4c67661ddd77bebdc6ba8d758e702357fcaf89549e72d82ae40731023d2698abc685cccccba1397dc055474f09502c203b2bdfa8697db64ce8f11465277e92ac1590d18e88bdf7b8fb8256d4eafdde7c5dd58331e4660c247ea12a04f8154137065107d6114337164916f6f46fb91ca559cba8e3e2418c840ece08cf26653614ee5993c7cf7fcd645f42efb6407cabbfcc864aa80e6580cc29c1a303eb63825da7394f837e8b3f8543ad5c98a0ea3c7ca0a5965e4c5d506bc453ad8be89b51ad3079113402f5fc6a8eefe5fb734982201d15201b96c6fbfaceecef3e4251432221bc93d3d0c08baa81a226e0157678426ae0ba094dfb6f5b444ee4203ccfb249041dbd7aa5b36fd63ad9be13ce8764fef9f7dfebfa4be81afb30e2614593331f2838d9b991a85d49534101aa53b477f7d8245dcdd0f4670f8ba915f155472725c4eae7dbc1a94fb2933e333b1b08b6993d07ab75198ded6bce15da1b9b983b60e2080108547acf769c0d99bf115a066475d4a83d81d334ed7abb09bd500b433f258b1d9bbd2266b401da50b3b14a094560202f8fe17670d23f4d93fadc97a5d65ba64e6ebed003a3df38a7fc844091f96753f069256bb52f96fe85d92376364cdc144644f5d5a48f5878721f667ae4cf463c7df206740cdfe8a80ffa4caea8e0e4e35201008c5b8fde05d90dad8261a4ea1851caa59a903c1cdcd4fcfe6fcb910ef2284921b5034fb71cfdeca242406fa5ed752fc08dbde31d6c88d1d4a1bc5eeeb99c2dec1cbad2fe5391cb5e6e1e75dea0a57bd8594111d14416392dee3946d4c81f0333d12c98552daa01688611d2e312b3435b12e2650e79bd423953e4f2f0932578ecd84bb4165b8b688bbee028106b5caf7b2c95a38dcd1fd6e5ba05dcfa329163eecb40f532b20a131d7c3b7e5b05338709736f5fb5264f883253e61ed641bea83de93f7c6496127ef8ab03f3bbded822c4baf47245094d9001d577a84a6f2a01bc5c720e368de2f582402b801884f828968259a35d514798849c8fc318da044d61c3d86c22c85e4076e85e65672f9b5066814875418109b4613fe008ee299bd055d52fd3d9697585d73adc7c36a54064967220c79354a8d687f3ef70d8b7118825ccf84cd2f3680c2b66c1d9741ec532f4e80779cfed91d41c919040326284764c5403d2b3f8243bbfa63094378ed16cfe932c60e7494dd6c11adf25e0909d6906bae92d4ecc8d8bc9ae52eefad08f2fc4d4e336e508bcd0fbcede1860ea24fe47d865f8e48f77638b5db1edf14800726845dadc9e48b35f6a4491f06932e105204925f29de8515a80e8ed132681b6d8262b44fd924eb1be07241be60bccd73c9d9431808feeb86efa1839fd7cf2acbbe4e139ecc9404b3300d57f411b2610b54afd465b7dae1508d28dd1fff33859f5b3e2a607a9b6c32ad81cceaa1ba59e4a306a2527bde97d9e050329575cde92c13c1b04b6c26f42a8fc0d77a8908cfa463a4b01894015740f417cc335ad56a927fc32acd0e4d2fdb4aac447a6ccc61fc5cf4067e57f98eb4f668e467a58943d2a10ec9010af98f5229b8b374f965fd7f311f1d2e37dd535f029018a851365c05df6c4ae0699c79e622d85fd319896fe7b3c7fa7e19a76d40b4f1a44acc90665fd5798ea473d0ac8a541c4a486a6105b344384de3ffa484a1be57c1785132c863c1812be347c4b2a8abe75ebedb64bfaa3b071df6b492da74d7cf75c2c51686c52593337bf5d9fc5ae18fff524301e568b7735e67caec35368bf4c43ca565ead2a38aa5cfb71cd36576cc89cb831b1e097dee35f0aadcc25bbd5ec107a88f3d8530524ec7a210b898f637cab73b686e04f1dae293b44a564c4e9179d903d88a580d893ee5eda97ae08abd14fdc0fb1941aebc49ecf99432364acf939bed65826765717c5b976795d5c7f468724a3e464830f30b0798a251ecc5d68077de4e6c47e7542c9764816abbdf41872633c34fdf62aef0170fa01c3c9d8ff6f71506dc9f35343e967df2c4ae0acdf5a870f4d8cb2515b6bae4f5136784b8268ec15878d49d77fe5c579481f1b36c4a20815a0958cf7013ffd00f9c6f4290154e6be456bcf78a3a8c47405fea30c4b1fbd167656a42acf2c2c3ed4f3510bcaedf67c3080cec1521284b55222bdad414cad0d3753dd635eacead3d317c74059ebb339e89a16c323e0f1496f7a3ceff1d21c37602075f736b56c68e96a83a79d7a18766342c530579ae28b9fe8659a6868b8b64e4df08e2eef6c0cff9080868dd1331469a7480d91dc48766c7e0b716ba3455464a256e08c4f83a2f407525fa89de3f336b5a0ae03f772d8ccce0ad9d51097faef3d0eb976cc199bbc25fd3ab74e2fb9e55cfa28c7cfe653e7b67e9e10a63c4760339933cb296900ba7bb17ee359a31b4c779d9ee17c1b373483d20382c20f3bfd7a9f3baa53639abf48481cb149b57de60e8c41a507d9c4af6bf48a2642fd7dbcb0a84f2085434b48013dbd40e7e8c37c73ae4d05165927077a4515b0519406c774d453af821ccd0f7e1839c4c65fd983737be0219319360e6dd63d2c37a20f348c4a88a29f2a1ef0ace7343c1e2374a3b289a92ee602fc2e9783839cc1aa36ccfeba0b16c439b5def897a1ee32bf07637876aadb1a61293346fd59233602f504f1763b6c9c8a04ac1843e791e62c493cc7a78bcd06708f3c836adf0b2c546ad375d35ec74f4c183d91a71277654e20a060159297d5a6a139b4d1de7a935dd14e0048ceb7876929774c6377c7cf7c947de68aa10984afd26e16faf7f607fd978fdf76de4f5af6304600e13a0af0b6e6006befe205209b8a467d3c609f1485ea7bdc297b532601eb986934f3f9a7935b47a013ec3898547f9638ae1d07d7f736403ec509a8a365ba6d8fc5c78e9c771b84014c4439750b64ec2ab4dcebdcebf06f106a8d201e94130d0296d79212e5e77b0404ee316703300d93a92253e934a9db47dd58d55b24e7ef7f934e61833ddab79bc01c1d9b899bd89ca5e8ee9b3ff66b30dbd547c5fe4440fa874744d67ffb9f2bc4aa1c5de5e97ed8f845b9be2d9c69a2bede31296f59f9b02b08492392c7ada8a62af9a9caebf0a33c0f8b202b9c6e90ee348203d29641ca4b5fafadb7b788960ddaab000dc59772cdcf1b1d23d136d4d706e09d3793e9b0769395ea0b344d307d8ac5c233c2fe40eab65a92eb96231f1556ae2ebc57b043a7e3becede6b4765f4e14b3979f99206f7559a25ff038ee0d3ef1591a91eeb47a78176aae333adedddb685b3da9a4e3f8348998dc86486234cf6a7ad0fbaad34376626915ad1fefb620f84f9e3338f018ccd2a8f8092a81343357384b24b314b40fa1a3cbca12d8984e26f2e722c62349553aff59a055f8bef6f9e2a689909f0d67abf4e64c369d7110d78610c0ca21737b38ee6e5b477d9a46739466ce686661d3463ed32c14ef34bddc444159df17d43b7c9e35a6fb667a3ccef236fa9e498451a323a379f04e53bc95ef32d15dd4f236e95b2a2bcb90ed16a772504a9ddeb6a6fb5475650a8ee50940d612c6417549f71cffa44eeaa108f34ca11da6154a563522ba8b39bf638a1bd2c44cff61c822212871ca01c6b8034bc68a462f145f58ecf2516ba6cfa1991ed63b5740735d64fad996432730324bc2d117bf420ab2f799e495073d8c07615522733275627d994d68aac8bc6ae1866b52596d57bacb3f58664cddad832cbff7bddd8044883df5858d20162fceff2833d95c4e8efbc280c13e017011e169bd028e4998f44b3becdb2479b4ed3e3d454311c1c84090f38eec9c664de50b88cc7e5de4c767a8a3f98612d98970e191c4c1128e92c051d94cba53b07ce11fb7673c15878cf48468a7133b57220a2cfe0ba838f5d376e006496684515ae31d87da8fdc85d1e8382d631241dd2d3cff357bc91cd7ccb1624425ce89552b1f297503b78ee94fddb0480b4ee824735222ce47d33b10eeb11c057d1d1c03ed428b2795adfbc766a0a6413c499dc58e7e131c110727a9b596dc7ac79d587a4a87fa380af81ef454ef27185d5c43134e696e7e5dcb370d39ad7a9cfcd53955907c33ca309a1feaf80778294198fac53d169b916ab050d76f6ef802b60cef3b54500eabda908f1706f272f3f7095a1b87b9741639277c5e4442c78eb24e453926d3dcf45e3e93b0f40030a9c061949570776740bc24b7a8097b7b5db39a29dda49b487ae0eab4fab158e49b2e86baac50d1dadeae611ebb101d9392cf520722a359a79e0ee22f48b59e9753818154f2aca261b8ce4e2343543a4f9a00a950140a422b34f3580d5e31abc8367fa26dbffc2786a4b1d2aac5e3ed26359aaf728c9d64a0768addc36de14b850e3c6678462eb8d2793e3c204c12037f5de7379e132b980cf92652de3a70f70b2671e39dfdc83429022c569a3c9b69397e4e8016ce4c0ecdf9993090840d9a769cbd2446035757343616f62466190c67d01634e9656c0cb734b040eca818e2cc5cfd90a333638582596daba84e5911a46a8ddc9e615814c0d56b5b9bafd4a6c060dc1bf90df691b56260b1970108afcc6f0126ad7143f4a42737790137ed91b971e240bb3f0d729a71adb9470389ac1b645c6c882abe323b97e03caab6b05b59806df4ccbb0fe296ede220a3f7884592263f1de8a2d8b82b2d372b32ebaafcde48201282da84ebd4eff605e7a01f828415f1d352e9a01cdeeee0c75936b96856ce49d5069596ca63ac1fc2d297e4c252cf74c0b7d2294c40ad081ac2f2344a31e36f28"}) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) 18:16:20 executing program 0: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_PMK(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001800), 0xd}}, 0x0, 0xffffffffffffffff, r3, 0x0) write(r2, &(0x7f0000000080)="01", 0x292e9) [ 2013.347761] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:16:20 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:20 executing program 7: ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x7fff, 0xfffffffffffffff9, 0x3}) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000040)={'filter\x00', 0x0, [0x3, 0x14c00000, 0x7f, 0x6, 0x80000000]}, &(0x7f00000000c0)=0x54) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:20 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2031.418085] FAULT_INJECTION: forcing a failure. [ 2031.418085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2031.418957] CPU: 1 PID: 10069 Comm: syz-executor.6 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2031.419524] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2031.420092] Call Trace: [ 2031.420279] [ 2031.420445] dump_stack_lvl+0x8f/0xb7 [ 2031.420729] should_fail_ex.cold+0x5/0xa [ 2031.421026] _copy_from_user+0x2e/0x180 [ 2031.421313] copy_msghdr_from_user+0x89/0x150 [ 2031.421624] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2031.421975] ? lock_is_held_type+0xdb/0x130 [ 2031.422291] ? find_held_lock+0x2c/0x110 [ 2031.422587] ___sys_recvmsg+0xbc/0x190 [ 2031.422870] ? __pfx____sys_recvmsg+0x10/0x10 [ 2031.423189] ? __pfx___fget_files+0x10/0x10 [ 2031.423503] ? lock_acquire+0x32/0xc0 [ 2031.423786] ? __fget_files+0x270/0x450 [ 2031.424077] ? __fget_light+0xe5/0x280 [ 2031.424368] do_recvmmsg+0x25d/0x6e0 [ 2031.424638] ? __pfx_do_recvmmsg+0x10/0x10 [ 2031.424939] ? lock_is_held_type+0xdb/0x130 [ 2031.425247] ? vfs_write+0x492/0xd90 [ 2031.425529] ? __mutex_unlock_slowpath+0x15c/0x5e0 [ 2031.425877] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2031.426259] ? syscall_enter_from_user_mode+0x21/0x50 [ 2031.426624] ? lock_is_held_type+0xdb/0x130 [ 2031.426942] __x64_sys_recvmmsg+0x213/0x270 [ 2031.427250] ? trace_rcu_dyntick+0x1a7/0x250 [ 2031.427575] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 2031.427917] ? syscall_enter_from_user_mode+0x21/0x50 [ 2031.428287] ? syscall_enter_from_user_mode+0x21/0x50 [ 2031.428682] do_syscall_64+0x3f/0x90 [ 2031.428970] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2031.429367] RIP: 0033:0x7ff14f238b19 [ 2031.429649] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2031.430927] RSP: 002b:00007ff14c7ae188 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 2031.431457] RAX: ffffffffffffffda RBX: 00007ff14f34bf60 RCX: 00007ff14f238b19 [ 2031.432267] RDX: 0000000000000001 RSI: 0000000020004540 RDI: 0000000000000003 [ 2031.432784] RBP: 00007ff14c7ae1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2031.433348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 18:16:38 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x21244cfbb7be7f00, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) 18:16:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_VENDOR(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001780)={&(0x7f00000017c0)={0x1040, 0x0, 0x87d27e71721737b5, 0xfffffffe, 0x0, {{0x6b}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x5}, @NL80211_ATTR_VENDOR_DATA={0x1004, 0xc5, "e58533f04f1208075b59bbc122abbda1daf24d317cda7ec8309b3195f9f1ab21a0b44b3bf5e701af6005b7c65362f0d4883a1b3c90f0cd7067238032c942abf022f656416a16fd396f1999e0dd69168ad708ac643d7882dc109300d2571f6e1d6d092a14b64ee46f69b9bff0dcc603e364cbe13bb121f3020933562ecbf2987e03e8629b242cbd92f552f0a0efbc1536ddabde25b0139176081c271d056b21f0255d19bdec667426848fd35d8ad73f5ee1b4627d811f6104edfd037e9b8aa390b1c747d279b23b9840171be345c8cd89300ea87879b39a1f245fe2d9691c30ac77e717c3c4fe6dd5f4f464e7afd2ee68f83a4de585cc448a8809ddbc1d5a9462134d133d06b67ad2c104ab1c52b9c13f8b934fd00c14e9ba40795aa943441d69b7452e2a8ea4b3655446a368d902c32ec571c3cf0338be262d7c94b636776a33f133b44ff569d16458c733b91711aed971f122fbcb2f40ce1013d920d91a179ed6b8f3ed88a60613d3f773245ee18fd94de563d0452530c003f9958f2a18025dfac74d4eb457cc28f832fb45aaacbbea29bb7792161054df7182ba9cde48179c1b5eaa9fd2bccd4685a3d04d36b011827abe683c7d7c19732a4f428ab2fcd369c7b79e19214c209f792ba588ffb9959f3633f17502a2e0c3107f956c6924e628caba84db0e27088222dcd3fb8f43ca693da9b875aa0ff6a7e7691d4424879ced6eea9a10c694b66387d4f20760b901e31f36cb5f260c212f6920bd6a9ff71ca3ac5ed22b736a16ce75247d90999730d4084d285c5ac6a89577d6d94d28d9205dd466681b260bc6f08ac2721a4a3960662e5b6797c8274e8ef8c682bd25aeda935ea4e1710dd3379b28cbd5fbcc97bbf19024e96fc7076f36af058c6c1609032f8d992158b747d490c6bac0e8f11aed8b981603dd3f82c7344b7965c587559cdde080fde2a9134ac3f80a639806f4d2eea5c8c3e7185499ded98675276ca4cd7f8ba4d21f8b62eb822dea401f51b6e03735a8f24f3b144e2ad3cf5a707a9837988799cf15a1c035d616001f85297f5bc3d4a9e035ee9f9e119e4afad867b033efc65667a5db1f367b37bbc6a71c64e57ea1d0671b2f2899a4618b538e910449b3ab6609451161a46147850303336d804db254d64bde0d8a3b2d58fee6acc944a8bc1f10ed5ac79c9c8adcbe891f16411898224bede76b964ffa677e8f74de9c74b442986e4d42f90f93a3e2d577e7ed6627ae74ee86f78e771582741940e9017337bf4e77147b6dc37c526e666ed937c8a151682491756e020d5a71f65f5c4edebf4d66f94610e620fc7f337dd6362e0dcf027bc811e9e25ad7d22a3cb21d93a9a698b54b8e1e686dd54caad309fb7e1a64ee741844bb23ee7bc2796a375413daff83f6a7a7083c475ccf15041c35826054ff2be525f69fa759d09dfecd411c76227e49b2f2bce523b46e9830887833aead2f93e521f59261ca7a4579a4efceac3540ea89674fc712cf0713524727a380e79cdb0ce8f225b4e1dcf26d2719954a07372fe573e78fad1700538d2a773381527495bbfc506f8305a721e211bc04af03323212829dcf1d24ec6fdf4976c2bbaa80a1bf7a6e72622f510e81cc948b9ac4fad9e8599cc5039c92120eb170be09c1601ba83ebc10e499569f97408e370c2e096c8f305866f8c58074bb2fbfc27d3926e42e20959fdee67e3c592bb1ca8db2b074899c48850a26adcdf6d46e0f23cd90087d53fd54187262b9c0dd0c2b0cb385472b60184be9a83baa6a8425dfacf10260362a6f3d88c1c2949d59b91363e052e1d4f870ba98b1bc68a3f3a030c23fe56561078c9abfaa2a9605d555f7be52804e1e470c77c04b0b99972f842604552890259db67a9be229778deb7ec02b19b6b17dcc1ec93bb501611ced82dc69f4e86c1e8411f82ef811d9ba3e5e66fad8b91a71da33cca73ecc4f3d46f63ba57f6b4d623a1b4130a8777b01e3922a6e22b3c5b2211ed0b9e8335441ee4ce13def9b45b8f6e3d8f25b9b79bfd8f5197a29d14d7570da599bc158dfbfad81a7cf2f7af753fbc6a86060440fe99acc3377bfd29532701aa43282c953b3411917f23b279ffa802ac09a8c9bc60ee0d5e147e21b081cf8c0c0d06ae1c8279a15d5cc5e1ca9d9a1ce1a594419310ac6d3039ef957fca746108f3907f43f6bd388c6e2665b1af3bedbca926adcf91ac18649d75bf531f37f70f96f0c55fea00054705cadc69892d96afaf382c476d1eb435f25874cd0372edafdd76af72e94c36ddf142a459bd7746cc5220c52ff2f5d0af9fee73d9a5fda6a35ad9c90426233710c14296c9f3b666c9596218446f42c15a371e669f4b5b2022d1137bccac2288612120bfdc0ada546d3b296daa17c5a8496e9741e81b99f8591eff3af29a3360c776cefbe8c4ac6df5e5f42e23af07bb231aa01618c79f1cae4cc4dcf2358605d87def761910fa1e37cd484904a1f47ccb3dcec150ff897452e5c2c9faa787f9fdea3a7fec446d809a55a270a7808b6d12203d5caabda3107c6dfd9b9d561ca89503dc5dd861d3ce6ef75b7444e6a1d9e167993dbe4b73c43e5f13f38d2ce88d1a91667637284f0d4886cd1c515dbad2c6024e1f5f2f8aa2554a32e2d2ffbf6cbf05128e782faa66b62be99ff94884ed6d1bf660c1a94472e0477df75f6f2cf8dcc38e34d9ea2eb742adfd7339517b82b305e94788be648de2de0a2ba1b76785319f89a768f926b2c9d103aaf49b541e8b12bc9bc7b8ccb6e8289b3f7f68ffe37ed8ad1e13c06ca97b48901cd6967029d064f260a30677e92879d2c922081e7b758b1154fc4c69433fb8d43c8d006eb8bcba992bc13b32e719d6407d9d2396b290aa27832cd05db6f3789f8a65f836d981a0775f573342132a467b207c9268a5ea0517dcd1ea6a0d9672623e9a2702dfe000f105a10f737e019723f0af88f84359051a032d664e2fddd728c0646b3a36a188c326f7f6b45b1a5f34e9aedb0f182f9be408bcf94c7c57f98bd6038f6cefa6ae9a8258fc80b35a46ab3d96b681014b9371b81ffd87012c16f53d98fb8781964272e14401e12e5e33734d5d3966b2887de252d0a655142d1afa5188c07b9d879a0456aadbe6c6903080868440d2320fddc706594f0f991918fdbb3265399f835d5c86c411771ff455119442f9dd90eb130bcc54596d41329a82172864d968b283e1b090576c8c24433490e8af88dfd9dd6a7526ab9f90224333fa8552dbe02127fc1f9eb6c8b6c5f2b382149958fe4050ac6023f3a147f92e649edf845d8bb08a2b30a46107085a6b5f6474103cdb5dcf870a16ab1dab4b49d03892a405c38127c67af2a6daa10590a12367ec652820ec08bf6b65874ea0bccfdc6a2a4821385ce89eb65009b8ea5585192c202801e372fc72f42cbaefbab5caf01448806268d4c1200393c1c550301a826a818892230cb8aa19931f29a51b5fd4ab181c2cc4c69d31826b58aa5e600ddd51382d2a929a287c7655429cf289d079df092e4f5e063e88afadc1ffd087104d2a6f6e066311922670e2c8b9bde1c84ae5ce7c80a6d46a847ab8d7401f4cc633de8fea0b084c2b4aa9c70a266d37ee393c4cce13f29679323df36277c8bd82b35375464ab8de461fe00b6043ff561f8a2884c3396342b14f669bdcd9b1cbe78696fdffc306c1ef177d0db436c13ea7dc64d2c8e995f6fb4845599227819bc76d5c3966967da8baf34b505dde29a52b071b9ec5e6d8a83b5ff2bd78b1851bed3c7ec2c022264039ca89106da03b5c941f402f000812d478ad7267aacc76dea67a791c8be96782d7ee9651b39fac88f08efd94b83a2af623b0a0cdee3978d9f4feafaa203bb8b8cf5a3acee7a0a3ea36015cce17c3c93d2c81690708ace3adb76730501a79d2cfbe5e8636aeee06d5b4a948b1f10458d5f2e638520116fd313f25845c81050e89274b3acfdd046b099e4ef44a2d71a50c92c626808daa66edbe727a0e8ecde1b9acc2813d8c7b80b678b5288d14c9a815551a21571b54a910fa52840625ae4c7f0f05a8c3dd0f6443e31feb6056b256f8728f6ed999d879f5df808bfdb2a2c6f06c11f3d4e9b47ab5865cb0381987ce69c859aa140723d0dd373fa0649d063775085f4393f571dff9babcb0cc5e80ac5170de3b8028c80b8ab1083f8cfa5dd799ee9f588012e6165717491e7ee00d013e0dda8560f2c9304dac687b52cce91623a59f16380c9ee648a66f28e7cb5898a14785aa3487c20628f3523174cffb46c5b010be23f6b352ae9ddbafc0c2835e93ffc1e247fbff1e11581f2ac144140101800c79478ba6325d05da4d908945dbabcab9b6837a2b7468e6ff871174c00bdd89092b692d802447578d8ba84ddcc420425c60432d6cf290f39314969377db4a3bc5fcfa10c946616be0210096cc72b6f379ce8013ec5c2a77b1afd57b6efe72332c46790ff700683f0bdd4a11a5493032aa15564cb271fd78d9c20672d2561479b8551a680689f0676fc4639e0048f8c47eeb206db74db78051aab09f65429b78edebefc6f9f6a36725eb08769044c2e233e8eab79471ddb4638275155db5cc21592ae34f2c6e5b54b8073149a5814173a84c9ee991bad3752531f919f1a8c27bd0a617e4b31e9a484381318cd2dfcf73327858e07d92091906f83baa3a1636728613a5d798881ea055b3e2fb7f1a34b230da6780f480374ba5846ddc31feaaf5f5789e341e15aa7a33bd9ee53e0d285ef2002406012ddbae87eda612209c827ec8930f313432b74a3c45059aec4dde2064280e010dfa7596e03ca2059555aa022e399b947ef5fa797c0bcd47206b814869bcc42366d4ceeaa91a5c17f36ee602b3d791d1dd68eaa29166e6c02ae7bb2eab0f606f01178452eb65ea11ea7f47fe6d32b83fd1fb30c77bc20162e65dc51ae7b785c830ffd633e313adab3d90b0e4d618d2af325a083a749bac0ce3b78e15db6d32172ff9a58b052ca437811a9990c73c4210b98b758035e18079b64319a0a760cedff04dcfa277c07b8f546cce5ecbc28b3f06c4a9523785d838bb68140107f7166f07e624871ba880dc1192cfc3d868d706674d2696649d4fc664e34620a039f0603a37190cabb88d9a2c03bd490d1606e768bfbbb75e48a02970b49c4461108f0e4f559ac6750d99299bfddddaa9bba3a4435af05fd480c5e7e1412063c8b1a3c708d7dce9f09d709d52fde49a63d2ea5447ae3c5c66516828ec13a1426307050ec46e6c8dc7380a5eab6523812b952039b572736473fbfcb694a162b1bced56948c0c72f277414d60616890f15150b77cc8a92ed2013d2542f47dc35afa3c5585112fc2e1fc7b1e8e52f831366ae5c538911061054f78caa48079df087be7a9f96e710bc73af680f5cc41bc078c8727b8d6a3a4f59d70370bd4274ef247b67a1fb0e4891ce4bcab25fe77996d3beb4632cd533aec9e4ce2265d53166810774268b14ab24bd86da7416f375f16c6b82eb37ed47f5c8ddd356079fb76efc15606747971d8c2af89f2ea4fa737226806e827866df5e08a68090843d0b00eb5113ca8248aa6a5d4425d07e68c3725dc66e5b1dca34210a79f72be9a8b5ce6aa97d8fb72235cc43a0c7388c56e9279d5623839417bb898d2ccc2f69c799597a929962e243b0963a115f1921c4eb390fb4871d59a7685eefe34986ddbf2a0faae25742e519783d7fc6d5528b1ea7087329c0e32fe0bc26448d34b49661e26dc45cb54d65015635c6b398ab513c8683c4b34178bf49f4877894c597743816c9"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x2}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x3}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x506}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x7fffffff}]}, 0x1040}}, 0x20044095) sendmsg$NL80211_CMD_GET_SURVEY(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x600, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8c0}, 0x20000000) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000140), 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = syz_io_uring_complete(0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) perf_event_open(&(0x7f0000000580)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}, 0x0, 0x20, 0x0, 0x5, 0x6e, 0xa2, 0xfc00}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r4 = openat$sr(0xffffffffffffff9c, &(0x7f00000001c0), 0x105802, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r4) sendmsg$TIPC_CMD_SET_LINK_TOL(r4, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x68, r5, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x2, @media='eth\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x60000090) fcntl$setlease(0xffffffffffffffff, 0x400, 0x4) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000004, 0x2811, r4, 0x0) close(r4) syz_io_uring_setup(0x7668, &(0x7f00000003c0)={0x0, 0x132c, 0x10, 0x2, 0x371}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000440), &(0x7f0000000480)) 18:16:38 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x4400c3, 0x0) r2 = pidfd_getfd(r1, r0, 0x0) pidfd_getfd(r2, r1, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:38 executing program 5: syz_io_uring_setup(0x1eb0, &(0x7f0000000000)={0x0, 0x3619, 0x2, 0x3, 0x33e}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r0 = syz_open_dev$sg(&(0x7f0000001000), 0x5, 0x0) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x7, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:38 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:16:38 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:38 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 1) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2031.433939] R13: 00007ffcb96f69bf R14: 00007ff14c7ae300 R15: 0000000000022000 [ 2031.434572] [ 2031.456613] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:16:38 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 2) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2031.552837] sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 2031.554200] sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current] [ 2031.555186] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present [ 2031.556093] sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 00 00 00 40 00 [ 2031.557089] I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 23 prio class 2 [ 2031.559896] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.560710] I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 2031.561808] Buffer I/O error on dev sr0, logical block 0, async page read [ 2031.562895] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.563702] I/O error, dev sr0, sector 1 op 0x0:(READ) flags 0x0 phys_seg 7 prio class 2 [ 2031.564840] Buffer I/O error on dev sr0, logical block 1, async page read [ 2031.565819] Buffer I/O error on dev sr0, logical block 2, async page read [ 2031.566785] Buffer I/O error on dev sr0, logical block 3, async page read [ 2031.567742] Buffer I/O error on dev sr0, logical block 4, async page read [ 2031.568700] Buffer I/O error on dev sr0, logical block 5, async page read [ 2031.569672] Buffer I/O error on dev sr0, logical block 6, async page read [ 2031.570639] Buffer I/O error on dev sr0, logical block 7, async page read [ 2031.575807] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.576870] I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 2031.578070] Buffer I/O error on dev sr0, logical block 0, async page read [ 2031.584625] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.585468] I/O error, dev sr0, sector 1 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 2031.586598] Buffer I/O error on dev sr0, logical block 1, async page read [ 2031.591791] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2031.601538] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.602605] I/O error, dev sr0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 2031.603995] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.604806] I/O error, dev sr0, sector 3 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 2031.606992] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.607771] I/O error, dev sr0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 18:16:38 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:38 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:38 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2031.619345] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.620592] I/O error, dev sr0, sector 5 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 2031.622094] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.622825] I/O error, dev sr0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 2031.624194] sr 1:0:0:0: [sr0] tag#0 unaligned transfer [ 2031.637333] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2031.638515] FAULT_INJECTION: forcing a failure. [ 2031.638515] name failslab, interval 1, probability 0, space 0, times 0 [ 2031.639465] CPU: 1 PID: 10090 Comm: syz-executor.6 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2031.640022] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2031.640583] Call Trace: [ 2031.640769] [ 2031.640934] dump_stack_lvl+0x8f/0xb7 [ 2031.641230] should_fail_ex.cold+0x5/0xa [ 2031.641534] ? __alloc_skb+0x21a/0x310 [ 2031.641808] should_failslab+0x9/0x20 [ 2031.642086] kmem_cache_alloc_node+0x5d/0x420 [ 2031.642406] __alloc_skb+0x21a/0x310 [ 2031.642683] netlink_dump+0x743/0x1070 [ 2031.642967] ? __pfx_netlink_dump+0x10/0x10 [ 2031.643272] ? trace_rcu_dyntick+0x1a7/0x250 [ 2031.643609] ? kfree_skbmem+0xef/0x1b0 [ 2031.643898] ? kmem_cache_free+0xfb/0x610 [ 2031.644202] ? kfree_skbmem+0xef/0x1b0 [ 2031.644487] netlink_recvmsg+0xb32/0xd60 [ 2031.644783] ? __pfx_netlink_recvmsg+0x10/0x10 [ 2031.645127] ? lock_is_held_type+0xdb/0x130 [ 2031.645455] ? security_socket_recvmsg+0x99/0xc0 [ 2031.645780] ? __pfx_netlink_recvmsg+0x10/0x10 [ 2031.646109] sock_recvmsg+0x14d/0x190 [ 2031.646395] ____sys_recvmsg+0x210/0x5c0 [ 2031.646696] ? __pfx_____sys_recvmsg+0x10/0x10 [ 2031.647046] ? copy_msghdr_from_user+0xfc/0x150 [ 2031.647378] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2031.647760] ? find_held_lock+0x2c/0x110 [ 2031.648074] ___sys_recvmsg+0xf2/0x190 [ 2031.648371] ? __pfx____sys_recvmsg+0x10/0x10 [ 2031.648714] ? __pfx___fget_files+0x10/0x10 [ 2031.649025] ? lock_acquire+0x32/0xc0 [ 2031.649331] ? __fget_files+0x270/0x450 [ 2031.649641] ? __fget_light+0xe5/0x280 [ 2031.649946] do_recvmmsg+0x25d/0x6e0 [ 2031.650225] ? __pfx_do_recvmmsg+0x10/0x10 [ 2031.650533] ? lock_is_held_type+0xdb/0x130 [ 2031.650866] ? vfs_write+0x492/0xd90 [ 2031.651161] ? __mutex_unlock_slowpath+0x15c/0x5e0 [ 2031.651524] ? syscall_enter_from_user_mode+0x21/0x50 [ 2031.651922] ? lock_is_held_type+0xdb/0x130 [ 2031.652252] __x64_sys_recvmmsg+0x213/0x270 [ 2031.652575] ? trace_rcu_dyntick+0x1a7/0x250 [ 2031.652903] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 2031.653258] ? syscall_enter_from_user_mode+0x21/0x50 [ 2031.653656] ? syscall_enter_from_user_mode+0x21/0x50 [ 2031.654045] do_syscall_64+0x3f/0x90 [ 2031.654328] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2031.654716] RIP: 0033:0x7ff14f238b19 [ 2031.654989] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2031.656257] RSP: 002b:00007ff14c7ae188 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 2031.656802] RAX: ffffffffffffffda RBX: 00007ff14f34bf60 RCX: 00007ff14f238b19 [ 2031.657312] RDX: 0000000000000001 RSI: 0000000020004540 RDI: 0000000000000003 [ 2031.657830] RBP: 00007ff14c7ae1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2031.658338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2031.658849] R13: 00007ffcb96f69bf R14: 00007ff14c7ae300 R15: 0000000000022000 [ 2031.659367] 18:16:38 executing program 7: sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8034e, 0x3, 0x0, 0x0, 0x0, 0x3, 0x1000, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x4}, 0x40210, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000003c0)={'veth0_macvtap\x00'}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000500)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x3) r2 = syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x39a}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x4420, 0x69d7, 0x3, &(0x7f0000000440)={[0x6b7]}, 0x8) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1c5042, 0x0) write(r3, &(0x7f0000000200)='E', 0x140000) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f00000001c0)=ANY=[@ANYBLOB="f9000000000000004ebadd074dcf5a13de034b0000010000000000c6"]) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'}) syz_io_uring_setup(0xa7b, &(0x7f0000000540)={0x0, 0xb480, 0x8, 0x2, 0x1ec}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) r4 = openat$sr(0xffffffffffffff9c, &(0x7f0000000380), 0x800, 0x0) ioctl$SG_EMULATED_HOST(r4, 0x80081270, &(0x7f0000000240)) ioctl$FIONCLEX(0xffffffffffffffff, 0x5450) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r5, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:38 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed}, 0xe) r1 = openat2(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x80080, 0x1c0, 0x3}, 0x18) bind$bt_l2cap(r1, &(0x7f0000000140)={0x1f, 0xf42, @none, 0x6, 0x2}, 0xe) r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x3, 0x1) connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x1, 0x2}, 0xe) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) connect$bt_l2cap(r3, &(0x7f0000000180)={0x1f, 0x2, @any, 0x2}, 0xe) 18:16:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x8, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:38 executing program 5: r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0), 0x0, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @remote, @broadcast}}}], 0x20}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r3, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @remote, @broadcast}}}], 0x20}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000400)=ANY=[@ANYRES32=r4]}) accept$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES32=r5, @ANYRES32=0x0, @ANYBLOB="001000000000000000000000000000000100000000000000f8ffffffffffffffb6d100000000000003000000000000000500000000000000000000000000000000000049000000000000000100000000000000ff010000000000000000000000000000000100020000000008000b000101000024000900f8ffffffffffffff491c0000000000000000000008001d00432829b0420000000c00150059073500ab000000a6000100736861332d3531322d67656e65726963000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0020000dcb9d33509153c2f9a61cdd41f951f282fb972f7196964ec4961fbb936103992828b7faa4705995164b4f50279c90eddf762f79068595b01f2ce9bb87b23ead4afe241be3e41584d9950a7e12f84230252bee35fca760dd9bfdb1f704907000008000b0000f0ffff00"/351], 0x1a8}}, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8840) r6 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r6, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:38 executing program 0: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) read(r0, 0x0, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, &(0x7f0000000140)=@buf={0x40, &(0x7f0000000100)="4f65854b3b0bcbcacfe1ed669ce7c43ae6e10bc028d82a49564ec7107ba5b75fd6807e75404cdae887d08e58218a8e7db9debe3c6dab11ba7e735b3f71b411d2"}) pread64(r1, &(0x7f00000001c0)=""/106, 0x6a, 0x8) r2 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x9, 0xb8, 0xb, 0xf8, 0x0, 0xc0720000000, 0x26100, 0xd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x4, 0x8}, 0x8, 0x2, 0xff, 0x6, 0x2, 0x5, 0xff80, 0x0, 0x40, 0x0, 0x80000001}, 0xffffffffffffffff, 0x6, 0xffffffffffffffff, 0x8) r3 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) r4 = fcntl$dupfd(r3, 0x0, r3) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r4, 0xc0189373, &(0x7f0000000300)=ANY=[@ANYBLOB="010200000100000018000000a1b4d27f7567254f25516cdc7f151eb38eec8fb3d0f2b9aded9d8249d2753a1ed5013e56b7abf702594aced338f3aebfcbc7f537a13f10703679781c1e3a6e26b375c5766c31d8b8bbbbdc3cba8150cdcd072f77a7843470174bdef24bf6a92b0a09cf5672860e5357b4f4c09a85163dc47b6a41e05f7236ea2810a2a3662962e0f55f3a78ea6fa221342cd09f2c6cffa7e140f63e5cedc8b82f906a49e8ea6d878c3f9acb4169", @ANYRES32=r1, @ANYBLOB="010000fd3000000000000800feffffff0000000000"]) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) 18:16:38 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:38 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 3) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:38 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x21, @fixed, 0x0, 0x1}, 0xe) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000)={0x101, 0x1, 0x101, 0xeb, 0x1f, 0x0, 0x8000}, 0xc) [ 2031.861762] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:16:38 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000005240)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/213, 0xd5}, {&(0x7f0000000100)=""/154, 0x9a}, {&(0x7f00000001c0)=""/74, 0x4a}, {&(0x7f0000000280)=""/63, 0x3f}, {&(0x7f00000002c0)=""/239, 0xef}], 0x5, &(0x7f0000000440)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000000480)=@abs, 0x6e, &(0x7f0000000980)=[{&(0x7f0000000500)=""/45, 0x2d}, {&(0x7f0000005400)=""/126, 0x7e}, {&(0x7f00000005c0)=""/136, 0x88}, {&(0x7f0000001040)=""/4096, 0x1000}, {&(0x7f0000000680)=""/64, 0x40}, {&(0x7f00000006c0)=""/240, 0xf0}, {&(0x7f00000007c0)=""/18, 0x12}, {&(0x7f0000000800)=""/86, 0x56}, {&(0x7f0000000880)=""/206, 0xce}], 0x9, &(0x7f0000005640)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x1a0}}, {{&(0x7f0000000bc0)=@abs, 0x6e, &(0x7f0000000dc0)=[{&(0x7f0000000c40)=""/80, 0x50}, {&(0x7f0000000cc0)=""/141, 0x8d}, {&(0x7f0000000d80)=""/27, 0x1b}, {&(0x7f0000002040)=""/4096, 0x1000}, {&(0x7f0000003040)=""/4096, 0x1000}, {&(0x7f0000004040)=""/4096, 0x1000}], 0x6, &(0x7f0000000a40)=ANY=[@ANYBLOB="1c000000000000020000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRESOCT=r0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000030000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0xf8}}, {{&(0x7f0000000f40)=@abs, 0x6e, &(0x7f0000000fc0)=[{&(0x7f0000005040)=""/224, 0xe0}], 0x1, &(0x7f0000005140)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xc8}}], 0x4, 0x10040, &(0x7f0000005340)={0x0, 0x989680}) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000005380)={'\x00', 0x401, 0x2ff, 0x7f, 0x3ff, 0x5, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000540)=@abs={0x1, 0x0, 0x4e24}, 0x6e) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x9, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:38 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x20000000, &(0x7f0000000080)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) bind$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x1, @none, 0xffff, 0x1}, 0xe) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x21, @any, 0x0, 0x1}, 0xe) 18:16:38 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2032.055816] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:16:38 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x82, 0x111283) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = syz_open_pts(0xffffffffffffffff, 0x8401) r2 = inotify_init1(0x80000) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r1, 0x50009418, &(0x7f0000001040)={{r2}, r3, 0x10, @inherit={0x58, &(0x7f0000000280)={0x1, 0x2, 0x30, 0x9, {0x2a, 0x7, 0x1f, 0x5, 0x1000000000000}, [0x7fff, 0x3f]}}, @name="60f7585dc2c74578ffe7148ef7455a17f39681762843e6766720e04043e84a9414cb9afd31687a28f67429942078796683b608593e6f32370aa7e1df30202a65ac669849b19e6e1bff56657ce7d1e314b7e79e423248d1a82d64a5a1f278fbf35bd66135cc928d37a70fd7cea11005f0de82c19beff907242ba4af31b9c4539e9949c47f0cd9766be9976af1b126c2da287b79be5920a0b94f7be359d2f13da33d61f62c2f1059164e917cbd4f347286f09839ef37351099c2ed05054553d75a5ae02a244012921a4e243b1e546aafa34d95c473c93da661755fe98583fc448e853a3033f3e1685422b215a334af68c7c51bf7723810efdb569f7e7de4981bf9af8bde2791d5993a9a240c5f5152cb0eb5dbf89848bc1f26e563984f66152e756cb1e172aeb28b1241327591fbba7f493314c6d458db29e082b8329b1d85fa9a399e075994e0c2b7ff8f0bcd2da13c566aad2e304833cb20ff1ae63f82b2b3a7e0ca0752923e0b7f7c73af8bfca3ae304986ed7d4ed5623829d5fa7ea3da062893f9c076af0b87df28d3617929da72b88c6e32ced194aabb6cbe0e3ee75698bb6b1393da1890e385939e6e6bb59994afc06a093daded66e81150553f29e27774fd966afdb74495ee67edeaba29727777f498029d575a839f44dfe993f46670f20997dd23d3147822551624b44062cd1b5afc19dc27644881fb0118af2dd756027074be219369afb714a40e230b0becbe22a647b33b0d71357de47d6391b4bdb7e2725723cb50db9bdc9d859da3064129b5ce677d9bfda2da3c8bcbbd9cc32d86a768fd7afaa6a25343ed3d5d9419fed00c303f70e6a747921c0fa784e02b4b9d4dc20af0f88eabca0713a8dd85ddc9a63e6241309679b4729f5db4f2734737c2fce4831ee5c9fe59ac53691af61d4189de9b52fee6e24292860ab2929953401e1e25b8e46d3fb0a912d23af610ca6a50a20a56c623e93911e9383f60e3b08def8521a0d5cf3b240ef8e81ff7502ed356f6bf325af6be68c093171fa37f7c1111c0b8170f77cdc66d36afd09bbab640996e8355364374cec79e3870f6a57d060a7c512949ec817b961378be67e3a05e479baa64f657a30271a41aa95476e265469e4cca87c6cd28c059b902d2ce40570a4da6e5216072b251fac523089ae894c764e6025b5e0452c58c522e006d048bf2a19fdb368aea82f9f3c26a22f5af12ae5beb58d04680e1e2b6296ff9d6ac3a0078465b53ad17b4912ea0620ff3b352365820d5efe2218bf6a414eeb0acf2906bd7c2b9dcf90ea98011dfee879ff1b77a28e6f5e6dfa999422292d7e034d5aaaacc4d5501173860afc4f812bda8c3724b1aaa5ce8042e68b58598c33c0392e1d676729fefab32744ee3f366c2d15656664fb635e2657e9d9193f490487df1349d80f387e9a32189322b45eeb8f15372abac015d6ec727f961650ca325903a2dc675868ed637536a8ce768b7e74a5b145cde06a71b3aed92695f8fd4d2c7ed5a5adfa1ea21e2496c6d9f424df6383e3361a22acab835d89507671e7a636b6703efc47ec22abfa6864ec6a5025cd8c406fb6760c16f9f39a1969d02e6762de16e3454a29f93deb8b55fc6348d01ae94641c72d06927a389b2902eb33e061534dd0805c09d70ed85fbc88170d28b73da7938d4d43cb4839c62ed6e4e3c83a09ec1c4ab6756db8e263bb651c916b80c7f72f86cd63d4d8fc30268c36cd5979a7169b0ad5bdaf262b8a00712398b37833b55ddbbf99185b8a98b20a24d0d5de013df3502a2b51cc4a810249c4586299cbd0f53c338d7f42954cb9b04663bfe835ca314b502c880580038e299a56d87d61d2ab2e8155c5e125c616274065f07161eb10b1b10609ed9a3ad25817e32544fd8fe1a13f7b062efa8b7a31d6fdd07ac78d7a1e4f8610d2c03a03340d8151fe171728040edc8aeab3b3d99c6850de5fd360ca2a5cb561912a1ab46b047575c5993280c811e2a656107780e18c8065b41069fb2c357f1c99955daac5651bcd8eea9fc41ee071bfb753f4a881ab070408ffecd1ad7b00ac79e059656b0d9703233b24c1cb004389c5b6f09f2e0c1c3ed64467feb3ec82aeb6443543008267cc94aeda8c1d0834bbd14eeae451c01e9372a14a72ca074d58b9461299c0091d4ad4e978e071bf78994c55eea32b67325baff4668dba01839ef2d89038f931623e4c2f5a7bebf12ebccaec0b5bd7b5de27019b7f4a0258804079086ab4555dbc9315e6d8400c150f2c61c7735401a11c7b04583767e0d9ae1548478dae3e90b27cf5b1e2483a34266283426650640e3fda65a0e38e806cfc4ff0215c724017e6d57401292eaa84de79006a50b0ad585191e4ab3ed08ae6c400cafcd74185165bf3f9a746741dc8d1027a22f5d42cbd1b52740f199c0bfb131daa2fb8e102e1c0c480496fa357b991fa901409b3459964f9e14a1e7a0bf4f97175510cfcf266dc27182c963f1bba8efce7417d482e4462c91fe28f6ad816ef3384210b62fb5ef8c5d12a34c7b01dd285928f64f98eb3d15744c0f5c396f71d317bb00153cfccd2b3239723ed5b2de66c8b22ff1c7fc69aebe562ba6551a9a054d844fc8c8f6069465ac6e94b099b70dbdb11ca74e926338a9443da287a2776cb76f2d9bd186a13b636e55d739b7e58f0aa84f13df49250aab2bfe33da866bc3be286d09feabad6ad3c384c121fd632dd65c63783c2a61868376f21dadfb09ebc034b3cb8d8908d969f649cd00005ece2fb4667191872f6d6cb872164c393d9b3d2a42639d1ae0f09699b371d9ad8860dc15df9454963b020a7f1138a001d1b2324bac864c7bb0f3a8313dae69bfe9b5f91ecd1ee7982dc90477217b2649ac7288234fc32bd4a01f1a3bfa69e5b49c6a68778d98d1e026301c5cdfbe242b0ba4c75ebe4dff715c704827992b0c3ea80e2e87c4f3f5febfbb9078b95d7d9ddcc9cb0c0660faed7832f9abfeed77d96558193b3394e5cae03ebe79539b35246f43a11fdbb9a8df66108741d345bd7f2b0c32155a5f5244ac5b3ba9d6317852f0d4bc94acdfa6f66d09cca0d3bdf3ed7137727fde2a845c8d1e838bb824e7a9026bbd5d07a8cd17f392e4f0faf2dffeeecf073869f4e59e50b81fed6cc8db9be1b352a88f4a5a9daffec88bdcf6b98ea066cf639048a38018864aa5d19b78a8718762f2dd0396d20393431c11fbe1ede862b9d757b75cd295ce3d5b1e465cd500f665c792e6704d576c6378df6258b45ad314b881918ffc89c8600cd4bb2996e5770c63059ec7eeec6e35b2561439bd4ab5a507faf3a696c0fa84ea0f39ea5cd6bf643f56941a62c0313d5adbab19268cab3ee2e18944411a0a3021a1ab6ee5cc9d9b29f2634ad5563d5061c5cf9c124dc96b986e73a4e5f4db5d969d0db52f5243c7332b975c2070de95ade8abe356b8b986ec8673db0fa42b5ff74729d78df2bfbcc148a7218bf0f3caf21f68be9eb6bf1cda05553a30509cd722938295566ba53f34d33a7a86dab32674c4a67fc12bec5ba2bb6e937fa75a2ac7bfb77c24525e8f3c6c8ef450ebec4acf67f298dcd548e3c56a192ef85987093539bff7ead8a8976ca2e44064acfec586291f46bba32fabcc38246e9fbbc324d58e2b9c964f97fe571b1eac6fed2061137eae68b1f6c28decf85a3403f0f7ed46ebf7150b707d01528e476e5689682cc19978f9d412cfde315e3e2c472bc5a85fd501f4c69815ce8da60c5de56034462a8b865f0b4f351528c2c34370057399301feafaa8b714272ae56ee401553d03f6c2aa4b5d3e81ca8c2620951bdb01564f0b6649c02084c68d4d806054429dd65ee4be023ce50cfbf0562e7101caaf6c1e8e548d2ee158def793ad35a141d7deab685102c1629ebb9994267f26e2155dfda53df87095e78107816265008973fbfd84b2a4ee5cc4dd6d67f1ea826e6f7702f44e9b9b4793a5eb6e3831228a3d78042819bee5bae0e100608883901dcbeb324e05ba286ef6d73a1693c11d9d834f01cb48ba3cfc1ffb8ea0be9fc4f638c632aef757da3958b56bf08f2d37963313ff42cde5fd6d29545909ea190425c6c44a07f64df9ca77967018ce8c84b48f3e88c22eb54f9aadcd501e3509e7adc0411be5b41d45825c991bc68ab130df3b26f04559a7455e5c1c221d8c04a4fcda281230ad07211da2c120204183564c195c31fa258cd56c5e66a71692c17a5f72bf780953a4cfd98036ed53a103c83f1b1132ed2b67daf74df04d6a38932a7d9e6d7cb81d8155052ad1e630f046f00477c345a98994b1291cd4077b5d72092ce96b42275b4097ad19852614887ddb753962976bb3ed525b646dab40a96882bf62600b87bd6f2a8bf915b53adb0e5d444440b0d8cec6e514ca9993a9aa136878c74b0eb8486d0c9b8b5b681d940e8bb040072d2547d32c221d1e1f841f8786bea0684dbf39b7bda60596f73e494fc502ea4dee6a4eb2f1297544ce95866d4748d865ccb35ec405e69904e86fcaa5f6070ed4bfc94e66130710499275fa8da227cd8112e85a6417c260afab698ce28d0d289cc18b2a8119f0fbd41f5e4d88ae1bf5793233efeb25ea3aec0db4747722afa59d4aff695ef404efa9f9b19612093bd94c311ce8d31eef1f77d6bb4f39e96780953026037bbfd6cfb6f807c60c22f15ac6ceabf24ab435efa92188dbb1b4a702475001299826a3a909dc54868a488be257f0ecf8e1cfaa395b0058754baa599d0dc85c897fd2c84793a9dbba01f073a141e5edd13e5bcd96d21af50eaa9cdc74c5d0c05c36c9d079f9c35a08177dfa2843fc7cc1e21bc0c8088d57b64112c436a490667d1f719e8705f77fc2da6c91ee1c9cf3247621e801af5a6256a40bcb97d931156e9bc124e227a5a70e8f9b2fce4182b62029a06cbc7b3921a23223d63acdc4dfcd58d24117b9b89683900853d273a4b8d8234b91866ceceeead13c3e597d3b60e93e85d2b88b0a43bd5b25e3f1c083ff1cafe1519e0a6f8362c6f14461ca918ac42d327b0c429562bff336c39092c5dd2e24986298efd6398a1c583c4d8cc1f338c7b6139c97bfb34a561026667b51a3a6f971a7da975c7d574eca639c15451b53d3d91c9a87c639ec9fc849c719c6e5dede84fd992dc49922aa056836e6ea6f81826877a19d4d776718d68647b7ec2b00f4e4e2569f0e4cd7e48db65cbfaeaf69133e7f2d744937c038007525422c4ed6a7aa6bb33c40d28d1f1eb0d19ff56ab90a8beb8195590475be1dd216a59279827b364d804a453ab69a40dc37fb66ca8a4d4cbd8bdc0058a829f1c43f878cfd968bffd7d80ef802e54993f2a1c0ddf26aca4dc0d55501725b321a15a326319a25ef251ed7a1fad5e8b46234b7b089d26630b7f29a307f6a1005eebfc673b2ecefdcf0922ab7ab21444c015e60521def5e47159337b84e23c139384eb57fc0b0df5db2f1ffa94b332b6c06b5c3b17abb029bfe6050d348f38f6189a3afce322eef72c2f99470421572d50748def740c9619db553b391358aa6449c602f0492ddba36b85821c32629291bc0d9ce97b916c427988eeb33f394d61f6f700e4daca79139be78db2eccbf826b929e83ed9fb5cea86ff1fe5d18fad37e92bff2b78cc7a915d721be9c8a68af129b9198e666efb04b4baf4743a44e5133946820337728ada50d15c51934b79abbee2869d0ee0a1c082987dccf8ebadc52"}) [ 2032.097759] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:16:38 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 4) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:38 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./file0\x00') acct(0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x185042, 0xd4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000080)='\x00', &(0x7f00000000c0)='./file0\x00', 0xffffffffffffffff) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(0xffffffffffffffff, 0x560e, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, "53f84df2337d06267d355323c44787ec323db2"}) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f00000001c0)={0x9, 0x5, 0x9}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, &(0x7f0000000300)={{0x7, 0x20}, 'port1\x00', 0x41, 0x0, 0xfff, 0xff, 0x5, 0x3, 0x27, 0x0, 0x2, 0xf3}) fcntl$setownex(r0, 0xf, &(0x7f0000000180)={0x2}) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) sendfile(r2, r3, 0x0, 0xfffffdef) [ 2032.339647] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:16:55 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:16:55 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 5) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xa, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:16:55 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./file0\x00') acct(0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x185042, 0xd4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000080)='\x00', &(0x7f00000000c0)='./file0\x00', 0xffffffffffffffff) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(0xffffffffffffffff, 0x560e, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, "53f84df2337d06267d355323c44787ec323db2"}) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f00000001c0)={0x9, 0x5, 0x9}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, &(0x7f0000000300)={{0x7, 0x20}, 'port1\x00', 0x41, 0x0, 0xfff, 0xff, 0x5, 0x3, 0x27, 0x0, 0x2, 0xf3}) fcntl$setownex(r0, 0xf, &(0x7f0000000180)={0x2}) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) sendfile(r2, r3, 0x0, 0xfffffdef) 18:16:55 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x8, 0x2) 18:16:55 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x400001d, 0x2) r1 = dup3(r0, 0xffffffffffffffff, 0x80000) openat(r1, &(0x7f0000000000)='./file0\x00', 0x101001, 0x90) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b980600db00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:16:55 executing program 0: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/cpuinfo\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x24, r1, 0x400, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0xcfbd}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20008010}, 0x91) sendmsg$TIPC_CMD_SET_NETID(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r1, 0x400, 0x70bd28, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x4}}, ["", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x24000040}, 0x1) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0}, 0x0) ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f0000000800)={0x6, 0x0, 0x20, 0x81, 0x6, 0x89}) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448cb, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) epoll_create(0x4) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001600), 0x400000, 0x0) ioctl$TIOCSWINSZ(r2, 0x5414, &(0x7f0000000200)={0xfffe, 0x65, 0x0, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="35a011be1b", @ANYRES16=r4, @ANYBLOB="010000000000000000007e00000008000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r4, 0x100, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x4e}}}}, [@NL80211_ATTR_BSSID={0xa, 0xf5, @from_mac=@broadcast}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0xc881) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x6, 0xa, &(0x7f0000004b80)={0x0, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @private}}}, 0x108) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000040)={0x10000009}) clone3(&(0x7f0000004c00)={0xc0002100, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x3, 0x40010, r2, 0xfbce3000) 18:16:55 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2048.557875] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:16:55 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) (fail_nth: 6) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2048.586700] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:16:55 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:16:55 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) open_by_handle_at(r3, &(0x7f0000000300)=@GFS2_SMALL_FH_SIZE={0x10, 0x4, {0x7b, 0x1, 0x5, 0x4}}, 0x22000) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f0000000200)={0x1, 0x0, 0x1000, 0x65, &(0x7f0000000180)="8eb5188d63b5afba70de57f5b98806dcc136e807440291c8d17bf5b2c55b61e55a7a6549b9cf7005d10796116ebcd48f55aef9579405dfa48f574bc6d95e60ec1e36fcac4e1a253de9907ec7d38064465324b00b75dc6fab859b6506e0721b38f4ca8f9508", 0x2d, 0x0, &(0x7f0000000080)="092a4d402b390fbb5c5de4b719bc1889555d4f286b4934a2d01db0141b53577266ed83befab669e947609442a8"}) 18:16:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x1, 0x0, &(0x7f0000000080), 0x101801, &(0x7f00000000c0)={[{@nodots}, {@nodots}, {@dots}, {@nodots}, {@fat=@check_normal}], [{@obj_type={'obj_type', 0x3d, '/dev/sg#\x00'}}, {@dont_measure}]}) 18:16:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xb, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2048.702658] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2048.703540] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2048.703540] program syz-executor.7 not setting count and/or reply_len properly 18:16:55 executing program 1: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./file0\x00') acct(0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x185042, 0xd4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000080)='\x00', &(0x7f00000000c0)='./file0\x00', 0xffffffffffffffff) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(0xffffffffffffffff, 0x560e, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, "53f84df2337d06267d355323c44787ec323db2"}) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f00000001c0)={0x9, 0x5, 0x9}) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, &(0x7f0000000300)={{0x7, 0x20}, 'port1\x00', 0x41, 0x0, 0xfff, 0xff, 0x5, 0x3, 0x27, 0x0, 0x2, 0xf3}) fcntl$setownex(r0, 0xf, &(0x7f0000000180)={0x2}) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) sendfile(r2, r3, 0x0, 0xfffffdef) [ 2048.719466] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2048.720319] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2048.720319] program syz-executor.7 not setting count and/or reply_len properly [ 2048.735780] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2048.736632] FAULT_INJECTION: forcing a failure. [ 2048.736632] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2048.737412] CPU: 0 PID: 10183 Comm: syz-executor.6 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2048.737926] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2048.738433] Call Trace: [ 2048.738621] [ 2048.738788] dump_stack_lvl+0x8f/0xb7 [ 2048.739076] should_fail_ex.cold+0x5/0xa [ 2048.739381] _copy_to_user+0x2e/0x150 [ 2048.739660] simple_read_from_buffer+0xd0/0x170 [ 2048.740010] proc_fail_nth_read+0x19c/0x230 [ 2048.740338] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2048.740693] ? security_file_permission+0xb5/0xe0 [ 2048.741051] vfs_read+0x257/0x940 [ 2048.741315] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2048.741663] ? __pfx_vfs_read+0x10/0x10 [ 2048.741953] ? __fget_files+0x270/0x450 [ 2048.742240] ksys_read+0x12b/0x260 [ 2048.742505] ? __pfx_ksys_read+0x10/0x10 [ 2048.742807] ? syscall_enter_from_user_mode+0x21/0x50 [ 2048.743171] ? syscall_enter_from_user_mode+0x21/0x50 [ 2048.743559] do_syscall_64+0x3f/0x90 [ 2048.743838] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2048.744201] RIP: 0033:0x7ff14f1eb69c [ 2048.744456] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2048.745732] RSP: 002b:00007ff14c7ae170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2048.746272] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ff14f1eb69c [ 2048.746765] RDX: 000000000000000f RSI: 00007ff14c7ae1e0 RDI: 0000000000000004 [ 2048.747264] RBP: 00007ff14c7ae1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2048.747762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2048.748267] R13: 00007ffcb96f69bf R14: 00007ff14c7ae300 R15: 0000000000022000 [ 2048.748794] 18:16:55 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2048.802753] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2067.345656] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 18:17:14 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:17:14 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:17:14 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:17:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:17:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:17:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) open_by_handle_at(r3, &(0x7f0000000300)=@GFS2_SMALL_FH_SIZE={0x10, 0x4, {0x7b, 0x1, 0x5, 0x4}}, 0x22000) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f0000000200)={0x1, 0x0, 0x1000, 0x65, &(0x7f0000000180)="8eb5188d63b5afba70de57f5b98806dcc136e807440291c8d17bf5b2c55b61e55a7a6549b9cf7005d10796116ebcd48f55aef9579405dfa48f574bc6d95e60ec1e36fcac4e1a253de9907ec7d38064465324b00b75dc6fab859b6506e0721b38f4ca8f9508", 0x2d, 0x0, &(0x7f0000000080)="092a4d402b390fbb5c5de4b719bc1889555d4f286b4934a2d01db0141b53577266ed83befab669e947609442a8"}) 18:17:14 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file1\x00', 0x101042, 0x0) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/129, 0x81) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220) sendfile(r2, r1, 0x0, 0xfffffdef) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) stat(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000140)='./file0\x00', r5, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x2000099, &(0x7f0000000280)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@nodevmap}, {@nodevmap}, {@cache_fscache}, {@version_9p2000}, {@access_user}, {@version_9p2000}], [{@dont_appraise}, {@uid_gt={'uid>', r4}}, {@euid_lt={'euid<', 0xee00}}, {@obj_role={'obj_role', 0x3d, '!(}@*\xb5*\x8a-\\'}}, {@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@uid_eq={'uid', 0x3d, r5}}]}}) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x220) openat(r1, &(0x7f00000003c0)='./file0\x00', 0x48c040, 0x89) sendfile(r3, r0, 0x0, 0xfffffdef) 18:17:14 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5804000019001100000000000088be1c138d843d57e8ab8caa00000000000000000001000000000009000000000a0000000000000000000a00"/76, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffc06b6e000000000000000000e4000600e0000002000000000000000000000000000000000000000000000000000000004e2000004e2401000a00a00004000000", @ANYRES32=0x0, @ANYBLOB="a0280c6d06ec4656152af1b361c32ca545eeed0688ab7df00e0845a61bf635bbc2bdfe7d8ca87895c6692c863fc4210f35f5069e690a2a03d16323e5092fddd65cbae10a8a8ed758bceba203402d18c2165570422b0e044c99b71a67b55a5c03050131fc9680b5a0aa8c4b711c8fb1714bad8173932311b1b276465f50647f06214fe1f157b5220ef94583dbe13fa50b3a9114acb707ee227ba1a01cdabf497659a32ad924f776aee996efc5620c044f077d33a884d067efec21ee7a78aa5bc43eae724fe02e21d84792e11ba213d1abe03719567687dfe4ebca3ceca7acc5a874d6a330beeb0db5f4", @ANYBLOB="ff010000000000000000000000000001000004d33c000000ff020000000000000000000000000001000000000000000006000000000000000400000000000000b09ce05f000000000100000000000000d777000000000000030000000000000000000000004000200800000000000000060000000000000000000080000000000500000000000000feffffff01040000010400002abd700001350000020004be62000000000000000c001c00", @ANYRES32, @ANYBLOB="030000007d00080079000800010471"], 0x458}}, 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) r3 = memfd_secret(0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r3, 0xc018937c, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) sendmsg$AUDIT_SET_FEATURE(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x3fa, 0x800, 0x70bd2a, 0x25dfdbfc, {0x1, 0x1, 0x0, 0x1}, ["", "", ""]}, 0x20}}, 0x4) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) write(r2, &(0x7f0000000000)="32999a17616c3c8b98c47edb00a43fea2b05448e95f869eb5635bdf3616c5487978d4546919d06bd9e", 0x29) socket$nl_xfrm(0x10, 0x3, 0x6) [ 2067.353507] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2067.353507] program syz-executor.1 not setting count and/or reply_len properly 18:17:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x70c6, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) [ 2067.419850] netlink: 928 bytes leftover after parsing attributes in process `syz-executor.7'. 18:17:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) open_by_handle_at(r3, &(0x7f0000000300)=@GFS2_SMALL_FH_SIZE={0x10, 0x4, {0x7b, 0x1, 0x5, 0x4}}, 0x22000) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f0000000200)={0x1, 0x0, 0x1000, 0x65, &(0x7f0000000180)="8eb5188d63b5afba70de57f5b98806dcc136e807440291c8d17bf5b2c55b61e55a7a6549b9cf7005d10796116ebcd48f55aef9579405dfa48f574bc6d95e60ec1e36fcac4e1a253de9907ec7d38064465324b00b75dc6fab859b6506e0721b38f4ca8f9508", 0x2d, 0x0, &(0x7f0000000080)="092a4d402b390fbb5c5de4b719bc1889555d4f286b4934a2d01db0141b53577266ed83befab669e947609442a8"}) [ 2067.457670] netlink: 928 bytes leftover after parsing attributes in process `syz-executor.7'. [ 2067.482802] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:17:14 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2067.498950] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:17:14 executing program 7: write(0xffffffffffffffff, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) [ 2067.689636] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2067.699801] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2067.699801] program syz-executor.1 not setting count and/or reply_len properly 18:17:33 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:17:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xd, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:17:33 executing program 5: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) 18:17:33 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 18:17:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) open_by_handle_at(r3, &(0x7f0000000300)=@GFS2_SMALL_FH_SIZE={0x10, 0x4, {0x7b, 0x1, 0x5, 0x4}}, 0x22000) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f0000000200)={0x1, 0x0, 0x1000, 0x65, &(0x7f0000000180)="8eb5188d63b5afba70de57f5b98806dcc136e807440291c8d17bf5b2c55b61e55a7a6549b9cf7005d10796116ebcd48f55aef9579405dfa48f574bc6d95e60ec1e36fcac4e1a253de9907ec7d38064465324b00b75dc6fab859b6506e0721b38f4ca8f9508", 0x2d, 0x0, &(0x7f0000000080)="092a4d402b390fbb5c5de4b719bc1889555d4f286b4934a2d01db0141b53577266ed83befab669e947609442a8"}) 18:17:33 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:17:33 executing program 0: syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2b00, 0x0) write$P9_RVERSION(r2, &(0x7f0000000000)={0x15, 0x65, 0xffff, 0x7, 0x8, '9P2000.u'}, 0x15) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_client}]}}) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r4, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30c) dup3(r4, r3, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) r5 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000200), 0x240800, 0x0) fstat(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2400400, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@afid={'afid', 0x3d, 0x8000}}, {@version_L}, {@cache_none}, {@cache_loose}, {@loose}, {@cachetag={'cachetag', 0x3d, '\''}}, {@access_user}], [{@fowner_eq={'fowner', 0x3d, r6}}, {@euid_eq={'euid', 0x3d, 0xee00}}, {@pcr={'pcr', 0x3d, 0xe}}, {@seclabel}, {@smackfsfloor={'smackfsfloor', 0x3d, 'wfdno'}}, {@fsuuid={'fsuuid', 0x3d, {[0x31, 0x39, 0x31, 0xd, 0x30, 0x65, 0x37, 0x30], 0x2d, [0x36, 0x66, 0x55, 0x66], 0x2d, [0x61, 0x35, 0x6cab036cd65b7e82, 0x32], 0x2d, [0x32, 0x61, 0x62], 0x2d, [0x35, 0x66, 0x32, 0x30, 0x66, 0x37, 0x61, 0x34]}}}]}}) 18:17:33 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2086.534726] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2086.551154] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2086.551154] program syz-executor.1 not setting count and/or reply_len properly 18:17:33 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1ff, 0x840) sendfile(r0, 0xffffffffffffffff, 0x0, 0x10000) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x4295, 0x200102) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) [ 2086.571144] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:17:33 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2086.614370] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:17:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) open_by_handle_at(r3, &(0x7f0000000300)=@GFS2_SMALL_FH_SIZE={0x10, 0x4, {0x7b, 0x1, 0x5, 0x4}}, 0x22000) 18:17:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xe, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:17:33 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="0180000001000000180000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2086.651287] 9pnet_fd: Insufficient options for proto=fd [ 2086.742843] 9pnet_fd: Insufficient options for proto=fd [ 2086.770068] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2086.782064] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2086.794320] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2086.794320] program syz-executor.1 not setting count and/or reply_len properly 18:17:54 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x2, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:17:54 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) setsockopt$inet6_tcp_buf(r1, 0x6, 0xb, &(0x7f0000000100)="832bfb4d9cf4031f543edba356e23940f86ef831d077a5afc5e74ff4c5ddaf0adce1af0d3c099ae8398c", 0x2a) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) signalfd4(r1, &(0x7f0000000000)={[0xe4000000000000]}, 0x8, 0x800) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x5, 0x25, 0x38, 0x0, 0x0, 0x0, 0x10, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x2, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x40, 0x1, @perf_bp={&(0x7f0000000040), 0x2}, 0xa00, 0x0, 0xffff, 0x8, 0x2, 0x1, 0xe5, 0x0, 0x2b1e, 0x0, 0x4}, 0xffffffffffffffff, 0x0, r2, 0x0) 18:17:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xf, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:17:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) 18:17:54 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:17:54 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="0180000001000000180000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:17:54 executing program 0: sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)="39bc903c7c6ce2ff14e5ae7d3c5664d2e4497fbb5bc37ab9065128546f74eb1d9f8f5a698b9cfc68077d4ad780790a6bc65d766c02ac903d4a5f98d8b13edaca6fca031eac85ee737eea8ff8d15237431f81c91776c3212de9cdb46acf19ec8b7f8028c80bbed26b1d393c6821e04e62bc8353a54de429d9dfdee050968f23b481be53e61d569ebe8d9cb41aac70c1c536cd304f0ee6219cd61df8a164a1e2fff6192b3cc104838dc77ecb029df0", 0xae, 0x884, &(0x7f0000000100)={0xa, 0x4e22, 0x8, @private2, 0x1f}, 0x1c) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) sendfile(r0, r1, &(0x7f0000000140)=0x54d7, 0x40) ioctl$FICLONE(r0, 0x40049409, r0) open_by_handle_at(r0, &(0x7f0000000000)=@reiserfs_2={0x8, 0x2, {0x101, 0xa7}}, 0x0) 18:17:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x4002) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) [ 2107.715846] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2107.725360] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2107.725360] program syz-executor.1 not setting count and/or reply_len properly 18:17:54 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:17:54 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000}, 0x20) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2107.806625] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2107.815607] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:18:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000000)={'\x00', 0x57, 0xffff3f27, 0x9a, 0x3ff, 0x2ee, 0xffffffffffffffff}) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$F2FS_IOC_ABORT_VOLATILE_WRITE(r1, 0xf505, 0x0) 18:18:10 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000300)=ANY=[@ANYBLOB="01bf00000100000018000000", @ANYRES32, @ANYRES32, @ANYBLOB="b4c00cdc2e2f66f56c65300085c7ecaee2d13bb814577dea30fb88c4e20a6256425577552ac4986a357b68f33659bdf760308fdb2767a475b7c0767b33d490f18f1ef7eb921b1c2dabc956f3cd624fd6e124d904fade"]) ftruncate(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000380)='./file0\x00', 0x0, 0x2, &(0x7f00000003c0)=[{&(0x7f0000010000)="601c6d6b646f736689254300080120000400004000f8000020004000030000000000000001", 0x25}, {0x0, 0x0, 0x200000000010000}], 0x0, &(0x7f0000000040)=ANY=[]) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000001680)={r0, 0x101, 0x2, 0x778d}) r3 = memfd_create(&(0x7f0000000400)='B\xdb/\x89\x03l\xdeb\xcb\xb54\xed\xbeLY\xb5Z\xe1\x12S\xf5G\xcc\xf3\xe9\x02h\v\xca(\x96\xe1C\xdf\x1c\xea\x85C\xfb\x10\x13\xfa\x03\x16\xcd\x17\xa2\x80\xa1z\xb4r\x95\xc3@\x9d\xa6\xf1\x92#}g\xd3`\xf7\xcez\xcb\xb3\x1a\xbb\xc48e\x8e\xb1&\xd1\x8a\xe6!\x7f\x8d\xea,qx\xa28\xbf\"\xc7e\x06L\xb06\xeb<$\xd7\xba\xe5\x01\x03\x94r\xab\xd4J\x03s\xaf\xf6A\xbfV\xfa\x1ew\x8d\xbf\x99I\x97\xd8\xd2\xe8\x11\xc4\x04\x00\x84\xd5i\xee\xaf\xae[E\x1f\xdd\xd7#rT+\xb621p\xaf[\x99\" 1\xeb\xc7)\xd2\x1dh\xf2\xd5s\xfd?\fa>\x9f;\xe5r\xe5\xbd\xb0|=\x8eZcPY\xf8\xbd\x13\xaa\x8b\xdf\xbc\x93u\xd5\xb0r\xfb\xde\xe7\xd9k\xe2\xc6\x1b\xf2o@&>\xf2M\xe7\x8c\xeb\xee\xf5\x02~\x85\x14\xf3\xc6v\xf15PE\x8c\xca\x16$\xc2\x01#\xb563\rbq\xbf64\xfaW\x17\xdfa\xe6\xca\x86\xd7\xf8\x81X\x9bg4\xc1\xdam\xcf=Rq6\xb0\xd4D=I\x1a\x0e\xd0\xabz\xe2\x19\x0fM\xad\xdco\xa4\xb2\x8c?\xc1\x10\xf273\xd00\xb3_\xe8\x9a*\xfcL\xea;\xc0\x9a\xdbx!N;\xb5x\t\xa4E\xbe\x93r\x04\xf5\xf0\xf5\x7f\x9a)\xf5\x1b\"\xa1\xd8\x06>\xc9\xe2r\xe9\xbb\xfe\xc0\b\x81\x98\x1c\xe2\xe0?\x8f\xa1\xbel\aN\x83@\xb1\x03)4A\x83\xd6\xcf\xf6\xb5\x82\xb7\x9dA\b$\xa2x\x8a@\xfaj~\xef\x93\xb1/L\x01\xe2\xba|\xf0\x01)PP\xcdl\x06\xfc\x15;qZ\xb1u\xc9\xd0\xd16~JEGm\xe4\x1e@\x9dG\xe4@\xdf\xba\'\x8b\x1cD\xc7\xec\xd1@}tR\xd9P\xf4N\xe3\xd8x\xa0\x91\x17\xc2}\x13\b\xca\t(Z\xa3_\xa1\x90\x15T\xa4\xe7%\x98\xa7\xfb\x8bp/eq\x93\xbf\x1f =|\xf3\xb1\xfcR\xd8\nM,\xcb%@\'\x15\x88\xd8\xad\f\x91|\x95\x8fq+\x98\x81W\xba\x9f\xe0elOt\xbd\by\r\x87\x1c\xba\xbd\x8e+S>\xb8\xe29\x91h^x\xfb`\x00\xdd/\xa6\xb1\x16=\xa1bw\xc5I\xb1\x00'/549, 0x0) fcntl$addseals(r3, 0x409, 0x7) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) io_submit(0x0, 0x1, &(0x7f0000000a40)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x5, 0x0, r4, 0x0}]) io_cancel(0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) fallocate(r5, 0x0, 0x0, 0x87ffffc) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) fallocate(r6, 0x0, 0x0, 0x87ffffc) io_submit(0x0, 0x2, &(0x7f0000000240)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x6, 0xf050, r5, &(0x7f0000000100)="6f010a59354b6a9454d49fcdbe288a88250be75500ea0a71f2fe16916db4e7e7", 0x20, 0xfffffffffffff800, 0x0, 0x2, r2}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000180)="3717faaa1d4849a604045bbef2f27358fa8f8047e1f5e943b85408a1ed3ddd52a719f3e6d090ef744639a3926b822b565d087b5ec54a9e867d3acd4d235f938aeecee2e6c224d8a6e05bfa9fc4958f5244e623edcfec5a9a", 0x58, 0x4, 0x0, 0x2, r6}]) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000001780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001740)={&(0x7f00000007c0)=ANY=[@ANYBLOB="01bc711d7ea0e79d03a9a53d3897b141a3b3843bf31f23eeb11f6f0000000073750a35ef3fff7b46", @ANYRES16, @ANYBLOB="000026bd7000ffdbdf25010000000c00028008000800070000000c000280080003000000000008000400000000001c0001800600010002000000e2fe01000a0000000600020011000000200003800000010000000000060007004e24000008000500170c6a050800050000000000"], 0x80}}, 0x4) 18:18:10 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="0180000001000000180000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:18:10 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000}, 0x20) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:18:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x10, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:10 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x3, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:10 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:18:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) [ 2123.828543] blktrace: Concurrent blktraces are not allowed on sg0 [ 2123.833732] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2123.840532] blktrace: Concurrent blktraces are not allowed on sg0 18:18:10 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000}, 0x20) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2123.874458] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2123.879535] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2123.879535] program syz-executor.1 not setting count and/or reply_len properly 18:18:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x300, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:10 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000000)={0x72, 0x20, 0xffffffff, "c7e8450ef6cd998bb00d850cb822dd9e768771a647d1713a296aedae6c540e2118db3a34168ecb27ad6970000c244724c25da574cf9e50fbf6064efa4efece57b21d428a994be371ec08d73319855823e06878bcf83410d21426bf99854fc10f4232533ef48a038899ddfeb2fe0ea4c03074"}) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="0800000007000000050000006bb91a91c18e4c0dcd5cf75643151e9ebd66987c057406000000a0b5640780d70c11284761b12c19f598d56c7375b4339d24752712a26466b8baf20a3b329e589133dcba4498b7dba52b4be8ac15f2148abf95aed77bbdcea6c80275bc1180b0d8589dfba6606558f772bea7b6b77cc314012e00e8aa919b44201c18e148b3c2bdf33394cb3c6f39bb892865e082f0976f93abf9a2ac47577bff24bc070500bb63abfc34bb43af4ecc"]) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) [ 2123.930998] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2123.953779] loop0: detected capacity change from 0 to 264192 18:18:10 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x274002) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) close(r1) pipe2(&(0x7f0000000000), 0x4800) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) 18:18:10 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) 18:18:10 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2124.003664] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 18:18:10 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:18:10 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) 18:18:10 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x4, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2124.059785] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2124.087379] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2124.107401] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO 18:18:10 executing program 5: r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000040)=""/12) syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) r1 = syz_open_dev$vcsu(&(0x7f0000000000), 0x12bf, 0x90200) write(r1, &(0x7f0000000240)="32999a17616cc86e4b010000803c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0xfffffffffffffe5e) [ 2124.114521] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2124.124163] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2124.124163] program syz-executor.1 not setting count and/or reply_len properly [ 2124.135460] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2124.150445] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2124.150445] program syz-executor.0 not setting count and/or reply_len properly [ 2124.194814] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:18:27 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0xfe1f, 0x4, 0x3, 0x80009d}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000000040)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) signalfd(r1, &(0x7f0000000000)={[0x80000000]}, 0x8) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:18:27 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x5, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) 18:18:27 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:18:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) 18:18:27 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) 18:18:27 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:18:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x500, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2140.724943] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2140.733195] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2140.733195] program syz-executor.0 not setting count and/or reply_len properly 18:18:27 executing program 5: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:18:27 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2140.775844] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2140.787728] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2140.794894] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2140.794894] program syz-executor.1 not setting count and/or reply_len properly 18:18:27 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) [ 2140.837694] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:18:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x600, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) pread64(r0, &(0x7f0000000000)=""/37, 0x25, 0x10001) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:18:27 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000040)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000000)=0xc0e) [ 2140.880421] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2140.887334] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2140.887334] program syz-executor.0 not setting count and/or reply_len properly 18:18:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) 18:18:27 executing program 2: syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:18:27 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x6, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:27 executing program 5: write(0xffffffffffffffff, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000280)={{0x10b, 0xc2, 0x9, 0xef, 0x364, 0x8, 0x38f, 0x3}, "73e15b34324e70256e4a15ed4618730078b09cc96f1e03fa8b6e311fd1a2d44f9cd19e503d5571b997c79b7d0f43552318b40eaaf942541d562fe29a875cf0821c40b303833327494040f0d370ca67a8d63d6182ed1777b4812a3400042e2db42794d4936f772bf54fae19d0a38aef5853a093898f01c2897c18d5b58a91e797eadfca66ded4706b7307122bbb58d7d6ce669dbf2f7416827cd95b192a307b04ce6884baca1f41bf39cb84290ece4688e85e8c5236b4c53f319ab72a1c65879d8a648389d96e4783a2b54710673d4616fa4a16bd38116a448938545b9c3ac59adf7464c2f8acac66419a91ee470dc583db4574afb4f7091a00b8e5b765a32394657da0f5d575ee5d49285fd390841ac0107ae9796a9d03ab8cb546c51caf8d963736388a431649285a8bef5150cdb44a69116dfafaf635194d5d9addbdc446720c46c53c48f97f3c7d29f7dfef2529fcf252f2d244e362c2be3bf0fe618080faa7407d3693c452354f06dadff33d390c77861b1ee3ab119f90f11f633656901e202bec5c7dceba761acf7d57857b35145271fb28176ac992bf1e89c9238b5497e396d6ea43e7cd05c75618d7a3d259b6b6a78660c642e2ae45d5724740c66be50931c255dd5ebf7ff225c4d48edf747bb47a2f6c56e03c5a9f9df3c49cb011b56356765cbc537d2778af49ef6c557a64e974a303e43a6846607cd1a6039de760638c9984e9993781d80a967bef97f4293f568c5a92e7cc146f4f5974e2cf4f02ef175da2a78af4707de20283172fb2390ef0579ba12f3bf6deec039c3f49f72458f57dd0f847fc900f9d6af79f9d6f9ce0f1013eeb0b9d1f532c1b06a31a7a9cdd4d872521b508d10cd4283716d480f8ab4309ec5596bedea48126ac82c78cd5dd15d759745565a9662b6f2ea68b79a9d22ed5e59fd2eb10a6fc6a05b475fe515506747e5b3fb40ad2b0f1fa938a332bd44518c301bb9b4e30fc561c05d087814a8b3af5d7f238325c5fa615d12f1ebf869dbb5157a0e73b98c8da4e6575775f5a7fe00e40c64caf62b2c8ae1c7387df1c0115a6d1d3d6f900d4c8731fe75948cc6d2e6e2226faa112e5a5df744a26cfbeefded038afd8681b9034b2e176347f8ec2df65c8d96b6fc9b65fc1b128e6494c06d495b311cf7da8d23e9ebeddca92ad72b350484e957d9070da4aa904ccd369cca532c80161fd48f554d09bc232d41981e6d6b4da69e748b3ffac8bbeda8b17c6c7f2c224609586529945e6a46bb72fe3cd4d039ebf196993d3767a3711f6e74b0fd24fa96fb20701092cf3edfe86ef976b1edf1f0e693a9edc592bde71f1a447d8b961be027345c2ae527a1485db6c527cab8854f0eb550adc4a593fdcfe0765a91ea1e992c8237cc2dc6b624e3eeb72f9391f1117010b16205fca9a8acad055a7f8790a590bceec7beb39710a6b75f2eb598d9ed99d4f18ac6b46799d0fef53cdf5b004d44077842de5a6e02f2f018145bc2ef82fcb8edf65c29155f2e9f9be2f354604340a0cbd7bfb71c2de499fc36290e93038482df1c1abf33841b3065175978bb095f6f96116dee891642f5f03518eccff833a07de70446790ec722ba5db78be80eed936a227e17cdac0caa274686e7cb795de7888d6b17499dd79a8867f6f7c3e959e066d2f12c0715b6aec641c07194c3a7e4f71f9a8ca6389de77f0d656297d3e629556a48073a67a4f3f2b6df96f6a8f0e476ef9c427fa0d301e753fd2424733956c7bb75e12e614ba14dfbf1e730693f8f493aa6968e50b206dc158980b0b22bdfe761cd5d5c8ecdfd045d402382e142bbcbfe60f766d9ddfb18eb6ed1429ec099aa634b23ccefbe79a2949a5e7e936319f1d99ff15c5a0b5cdbcd29c5d1633c894692eca3809b44c68dacd70fc92b496bcd46c986ef9a2fa4ab5693363bf2a391df565e1924c810e2134bf98bd8552a7dc9e418a280e60231f3ed3893ea4689ecb3c9052ba9c0f7b350a0ba45229efb88f9563d80a62230cd0760a1c804c353db0b727958f3f2b8aeb5bd7c7bd11bb250ee1b8d9168c44c5379197e4097b498274a441946bfc38a35f5ec78a319364871594022f3e4e319216061d301ed0ff1661e1b3e06892b23c14ecc2427102609d283ff1319624ddfb0523b10fc7e2b99bfafdbf9e56666bfbb8d9df37b81a745c5cdbcf47b347b99127a9ff35c03aa159ee6a126023fb4809312d3a3f420415421376f18ef119cd024d4447ea8f79b15aad61fa056163048b28c7f5f2ae74173fdeb4c9f865c2d385a20fd3467a559e828238c0a50a796418ed360ef7d13c5d7a52c961ac5b305c7161ef29709d92c5c92c0983e86b573e61a465fb01816d70f77e30ff22a7ac850939644052a98634fc750b91d59be9acc3cf3207f44db995622f72621aced0f332db61f362785208b58724bfa06a7bbca3c9882063e48cb65161e5e8a924586f63483bd7850b1f6c9a293c767e0afe18d4077e759ae7b3af779f3893287a460b5bc3935c3e8106a0670b5852b1a2f18ec960222bca5b0161090cf3a68a01e045e3eb8e3008b5f67d0ab2005b43ed2e96f8bc94a26fa04f49e9c8e82f3a5b302b677f70ff7c86759981bdcad5037505d3e1e10d62bbf12372a6ee58cb62ea6d83724c806001fed13216b5fb899ec152a2a4cb76120b758f815b4268473713a75815a6a4232221be45f721867b9e7a5618f79baa951159d3c464e7c60898ad0b0c0b1e77015817b5350460adfb382c5cf9eee307d53de55d1df1d1e1a300ce3ee3f77839656ab477f2b2589454f46750de14669bf9b1e7cafae453c9afe7aecb9fdce29c125e084d2b828ef237a34534d3a46d54df29affbd7fb308c1581e12e0be84a129bf5e71cf1602fc6ce2267a5d0f7b79a5b19503d2baf48c331693ee6b7c65af7063446a584d6ae4e8812873983a542b319619c197d929fb53099911fc0acffdac4c13fa065abca7bc898cc0e6d405442b3707ee713c2c1affb6b285200d905931c2a9eabbe6ca3adf621c956683c4b2bb8181c722d8ef185423de57be3c94dcbacd34617e86fc555c96b325cb08a43e0e365273600596e12156cb74759663be395248b0b2e72c6e1cb6afbb29634d21369b0cc2ff514b929a661fa00e29bfdb74e4f9383dfa0299187ad793356d12d873137a711f1447bb941af25c3c14004900b9643ad9426eed7b11a3eed2c4341dd9e94cc7844a9b28e14df50ca3d0d09aea688afe3f74d07c261b06a8ef1db1b5206e8ae7c7e20d291e09cf35ad7ac59abfcd36c59f2b3d407639ce4fb8a814e7a5bebc0fdf7e5bb96f8ad6af69ccce01938248008b4a7cf15343a98aaf3c72b7475ab75ef1804e45ea342ded76930d3b08034771f4e1e1a13619e5db71b61fc305d782cffb5cb604a38f8020e3a54ca7b346e0e997ce08f4dc8306b7b74a05df03a4c238f00b057f58f249b5ec42ffa435d6adbc1b8be2443168a728b293b739e9f8748feb11cca9144b6d77f24e3b532156781fe46aa0f43c868b39ca4ad1110c2c3de14df220970c89b54d249fd7551a952f6ec0912cbf657bb063dba5deb99a2646a07127cecf66f5e264bf84abb4335b64a017da557aec6413c49b92114deeb8be6ccd4c82faac230ee4e856a1481bcba5fa02fd6b5278647ecd26f3e47535ce49e663d467c83ef126783d76c1d61d96338eb7f85d7f23a3de13e9b0a20bf42e71f5804e533e4971568a3933ed9c66a5dc8664f47cbb2800be8afcf21ca2fcad171a2ce97e14c7ca084147d76590265a41db0d5631ae85cbf3185b37c07e4dcd0878c2c1b96bfe759502c28747b22b27aed893bcb2c208e5b32089e1971aeb4dc51ef83796e20ae3edd73642ece8fc83d32076b55cac1b30d0c40bb6f0f6e4a31daaf8c382f5280ade39766f179bee309dac783a477d2dbfbf7055d8cde59b7d189f6467724e1630f035fa4f64081be2d709979d85db8616b10bd80cb5e24f301e63f1636cffd0fc0411ee5b6d9622e7e0fc66cfd5ab7573c634520b2f145b964cc50e5aa90f7d6ab0bae1273ce53ea9f92338d2c1d2d9e2eff94c71949bcf6a5dc7c953113ecd28a081f4ba4b9c648f2cb17a60ba7959502a35a7eae90e0ae18d9468722d8ab4f7366c05c28ccc703362a6456a29e45e8619c0f95ccf0b4ee25a1159691fa1295c6b6ce51949540085dd93c33fb31cafa7f0344f353e8f0ce2769058e1f2ad0636c339b3972c9f2e22bfba00d9e8dcfbe0bf6f8d4605f2c07f43de7d2cb9f02b9b51c479486ea44dc59cb578f1c85f883eb295837c3e2b30b0798db78db9a06f67759bc3558cf3bc3929241b56abb3b6bd59a2d9a1795df08062b21b6446aa26e38eb35a036fe748c74002cea26799765c35de6ccf7c79b260d93eee8756e2352ac0fac4395039b98af50d663b1a1e8b3dde9c50bfe0c70b855a7a4af7a238d8cc579f8df825c7f7340a75a22ece0da2d0ed4c1416083a4522ebf9fe0d5b56ac5845028c4932f4d9b0eb9081d3d495ef23c45d5ffa47b28aca19d68aad2268e5850e5747bb32eca182611219b6d843450770551d87153d82828b5dd2167e0c9df63229682cd1a524d968eb84c59d1aadb4b1c02bd04a194c453ceca38efea0a704320736f2d63c4d125a5134bedb3fbc2eb3ad0c39c6ac71564e6f77325db6c51d31851ccb3e6942df890d4a7a4fb28612880f8d5a7068418158215ba238a697a4848ff5b69a75d1c3b0d967680061eb07a78a6a4b0a449a667248d641a78fa45495ac3d845b5aba501d516935f484a1f4ab16c3921eeba6d21a6974e889205f7b63c8dbc4b7fcb9e28ee217d0d3284f89d82fac33ea750805980bd91f1eaef9a6f2db9781ac3b22361f42c9d3b8c0da628ca70dbb6d9e8b1675f9eb3ad342009fdea5849cdf766c83ed52a94c7ffc5bc57e4ad8dc570246ff5a3a753af5a56bf599650f691389ccbf33f5be8c9fc76cb83bda14513aec86b27dd16da2404211e410c792b89cba4caefb7246dd735d36c0c52b64060e151ea723b3ba445ff49c279ba8c6459dd7324eea01af3a5f0d6ec55170ba5b5a3b4bb96fd1ef3d1745f9595c4b96a9f9ae8af14b68fb448f3497470411d60bb95af525a23e0621583c0d3ccc10d2d8ff480a271bfb3a9ea12fce66fa19287baf9c0b23edd4df22d663ec17906e6c4095db24dff625b0109c3fdda91e4d7a4512b87d2ca49a465e7afa0bce4d22330c1b234c581866ae30b8850b2f855f9b03fb6e9bfb650dca20b5edeb9b6d50d06df527198023dc2505496e7fdf3c3f556563eafbb6fe384a5b7548b8a364fc330ea44e364164fc59433898865931ad7b17a368bca8a9320319e33c1fa1bac8234756049d62430fa532383f75d64170b1da7b27846685862f694658d235180cd6a6e2afa78fc93d6a9287950c0c7ca92feb832059bdaccc281d46ecf390eec9ad9bf08f14a4a4e4a77c57c50abb29782bd0b335e3c7ddeee7f9e53638c95e3b04ac37f66d4f86d6ecd151146ab0e9c85aa98560ae5896933d9855764d0fec16e456d4e26b8421285f2ee56c7674171dc8eca8d76c7cf151d7f8b723d4623903f414baf48c2df61c0256c055f1b358b76d3d50a589ce90eeb855c05ce990dbc2e3f65ea5beb94cde33cea557d296a220e2ff599bf933e998c4ae25a8d9e3a808041d521ddd8a9916091d73b4d280c301301d73ac53de4d4e0b67e2224f7924d93f2742c5aedbfb6305bbeabdaeac58c88390e5e12b035c3e3a888438df547bd60d9150d7ab71b92ec29f65921e407ff0d93da", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x1720) [ 2140.970133] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2140.973403] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2140.973403] program syz-executor.1 not setting count and/or reply_len properly [ 2140.980902] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:18:27 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) 18:18:27 executing program 2: syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:18:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) 18:18:27 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2141.108489] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2141.108952] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2141.110722] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2141.110722] program syz-executor.1 not setting count and/or reply_len properly [ 2141.113965] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2141.113965] program syz-executor.0 not setting count and/or reply_len properly [ 2141.142563] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:18:42 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x0, 0x10, r4, 0x27000000) [ 2155.624510] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2155.627702] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2155.627702] program syz-executor.1 not setting count and/or reply_len properly 18:18:42 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x7, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:42 executing program 2: syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:18:42 executing program 7: write(0xffffffffffffffff, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x101, 0x1, 0xc4, 0xee9, 0x3}, 0xc) 18:18:42 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = dup(r0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) fstat(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x78, 0x3, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0x9}, [@CTA_HELP={0x10, 0x5, 0x0, 0x1, {0x9, 0x1, 'syz1\x00'}}, @CTA_TUPLE_MASTER={0x24, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}]}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x4f4}]}, @CTA_LABELS={0x24, 0x16, 0x1, 0x0, [0x91a8, 0x3, 0x0, 0x3, 0x3, 0x3, 0xfffff937, 0xfff]}]}, 0x78}, 0x1, 0x0, 0x0, 0x24000880}, 0x48090) fsetxattr$system_posix_acl(r2, &(0x7f0000000440)='system.posix_acl_access\x00', &(0x7f0000001900)=ANY=[@ANYBLOB="020000000100040000eeffff01000000", @ANYRES32=0x0, @ANYBLOB="02000500", @ANYRES32=0x0, @ANYBLOB="040003000000000008000600", @ANYRES32=r4, @ANYBLOB="100004000000000020"], 0x3c, 0x0) r5 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r5, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r5, 0x400454cd, 0x30c) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r5, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2, {0x20}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r1, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee01, r4}}, './file0\x00'}) 18:18:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:18:42 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) 18:18:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x700, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2155.676536] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2155.681555] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2155.681555] program syz-executor.0 not setting count and/or reply_len properly [ 2155.735773] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2155.740190] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:18:57 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x8, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:57 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x900, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:57 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:18:57 executing program 5: ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="8b279078000064b82e2f66696c653000"]) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000140), &(0x7f0000000180)=0x4) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@dev={0xac, 0x14, 0x14, 0x12}, @remote}, 0x6) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)=""/67, &(0x7f00000000c0)=0x43) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0582, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x8, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f00000001c0)={@private=0xa010100, @loopback}, 0xc) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0x17) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:18:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) 18:18:57 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000040)={0x8, &(0x7f0000000000)=[{0x81, 0x1}, {0x6, 0xff}, {0x8001, 0x3}, {0xdb, 0x2}, {0x1, 0xa3}, {0xb6, 0x200}, {0x7f, 0x4}, {0x1, 0x1f}]}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000004c0), 0x8a080, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000500)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) r3 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) pipe2$9p(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) r5 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r5, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r5, 0x400454cd, 0x30c) r6 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r6}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a80)={0xffffffffffffffff}) r9 = openat2(0xffffffffffffff9c, &(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00)={0x80, 0x8}, 0x18) r10 = gettid() setpriority(0x1, r10, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000004e40)=[{{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000e80)=""/17, 0x11}, {&(0x7f0000000ec0)=""/92, 0x5c}, {&(0x7f0000000f40)=""/32, 0x20}], 0x3, &(0x7f0000002040)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x110}}, {{&(0x7f0000002180), 0x6e, &(0x7f0000002300)=[{&(0x7f0000002200)=""/137, 0x89}, {&(0x7f0000000fc0)=""/52, 0x34}, {&(0x7f00000022c0)}], 0x3}}, {{&(0x7f0000002340)=@abs, 0x6e, &(0x7f00000033c0)=[{&(0x7f00000023c0)=""/4096, 0x1000}], 0x1, &(0x7f0000003400)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xe8}}, {{&(0x7f0000003500), 0x6e, &(0x7f0000003600)=[{&(0x7f0000003580)=""/115, 0x73}], 0x1, &(0x7f0000003640)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0x0}}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}, {{&(0x7f00000036c0)=@abs, 0x6e, &(0x7f00000037c0)=[{&(0x7f0000003740)=""/114, 0x72}], 0x1, &(0x7f0000003800)=[@cred={{0x1c}}], 0x20}}, {{0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000003840)=""/99, 0x63}, {&(0x7f00000038c0)=""/153, 0x99}, {&(0x7f0000003980)=""/91, 0x5b}], 0x3, &(0x7f0000003a40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x30}}, {{&(0x7f0000003a80)=@abs, 0x6e, &(0x7f0000004cc0)=[{&(0x7f0000003b00)=""/167, 0xa7}, {&(0x7f0000003bc0)=""/4096, 0x1000}, {&(0x7f0000004bc0)=""/58, 0x3a}, {&(0x7f0000004c00)=""/116, 0x74}, {&(0x7f0000004c80)=""/49, 0x31}], 0x5, &(0x7f0000004d40)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xf8}}], 0x7, 0x1, &(0x7f0000005000)={0x77359400}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000050c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000280)="aa3a9faea0040cbf6b0b4a7ee2fbc67d4e251bb95ccc44bb8c627cc2c953b7a5bd9be83f2f8d057b6c1439364dcaf282f0d721d9b5f165ed7b868a290f790d6e4c1e12a56f474310b4c2c55b4c82a8f5ad1fa03a973f3e6bbf536eeff173700971ef944d539541e120af2862448e2dcaceb3e550cf24cf5be07150785cff0f84ef3b18b5c300453c60fe9cb1ea5442ad428d09c89300c6d058b15ec66bbb0aa6905d017cd28e43fdad0e0951e03c96963ff6baebd7d7532c32e9c007dc0e35a0fa8935a6e1db3d4800eb744113fd7821f4d0c429fa42ea82bc53115b4fe6124bfbd1", 0xe2}], 0x1, &(0x7f0000000580)=[@rights={{0x20, 0x1, 0x1, [r0, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, r1]}}, @rights={{0x30, 0x1, 0x1, [r0, r2, r3, r0, 0xffffffffffffffff, r0, r4, r0]}}, @rights={{0x20, 0x1, 0x1, [r0, r0, 0xffffffffffffffff, r0]}}, @rights={{0x18, 0x1, 0x1, [r5, r0]}}], 0x100, 0x10}}, {{&(0x7f0000000680)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000a00)=[{&(0x7f0000000700)="3ed7b2df1e93e844e31af22431a50f35f934238c8497623e067b6d68988745662bed00641cb953d8440b7a0c66355bf26282e23bcac1fc45e716458b38a4d47ac11b160d90c5b401dd876eed191c98c497ee9b8d849c81911af27202fe89dc", 0x5f}, {&(0x7f0000000780)="f39ce91907e545d4279d562c38c11dccfdcc12d4b0fa1ee6c9cb25af57f4ee99329bfb26cc699d820ba097c7fd8701af0bcf8a4e620917aaa44b1bf6db40a1580691e707adf8fde6936b71a6c599d533b847cbcb2288252d3e66496f629f61da9ff20c786ab098247efa30fe7b73cffafcdb71d809191e5914e926b1e4e82c9e2fdf0dd61dc8fed26089c30988d6b16ab4416d9bf294c48580a099c98625b765848b1a68bdf73b9abb7fca7e9ab8faa73bb15aa4725652c92811f26fd32220c2c6012a3afc0d77b21fe0b91159ed459a981641408c940cf9bd663fbfc250f381c59913681b462835a43c8f390fe5fb286553f91da86ac9", 0xf7}, {&(0x7f0000000880)="8bf06096a6d3454179bace7fdf6bf3c8d97b0e9ab51058f51385663a6cc1c65751fd49822f1a0b5c208ec3dbd6e06c5be6ed4d7c397c7e2a6b1b4d908304396983ad5db895e53eb37b97a25acf396914245c77e8ee49697bbb6b804d5444a2b6722da09f022ff4c6d2d7b7ca15ab619632442bbb8d07fc2b026e5a56f96613a5e3e0cec7541d2beff52cf17bf08cf0b5978159440f29fbf287a3c8b84731f1ed0b9311548fa71963788039d7c28cb2862181f82ce8985cff95d57ac59e59b0a3dff50c540bbb3f3643cc056aab7f8303fd699125f3270bc0", 0xd8}, {&(0x7f0000000980)="8bb328d89d182b0eb9f52d1d045a1d15e258c3b8977ebd62de9bf1369a187437552a8eb58aa444994dbdad0884e7e1628c85bb83057d9b255acbca60c9d8dcf8d4fa4cd48c501fe13988b67475ae66", 0x4f}], 0x4, &(0x7f0000005040)=[@rights={{0x24, 0x1, 0x1, [r0, r6, r7, r8, r9]}}, @cred={{0x1c, 0x1, 0x2, {r10, 0x0, r11}}}], 0x48, 0x84}}], 0x2, 0x44000) 18:18:57 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x0, 0x10, r4, 0x27000000) 18:18:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2170.353615] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2170.355955] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2170.355955] program syz-executor.1 not setting count and/or reply_len properly 18:18:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000280), 0x20000000, &(0x7f0000000300)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000000)={0x3ff, 0xfffffffd, 0x6, 0x3eee, 0x7, 0x7f, 0x1f}) r2 = gettid() setpriority(0x1, r2, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f00000003c0)={'\x00', 0xb7f, 0x3, 0x7, 0xffffffffffff8001, 0xfffffffffffffff7, r2}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000100)="1089f771edd1ea5c0fd09f2ce9c00ac330e50ea0a26c9435173caa814c94bcde1d7291adfb05325092ec103ba75c25b7ae304404d3ce19de76eeb017d500000000b95fb228a2694aeab3355321ad2381a500710dd2f780b46148eaf09010b9a9993a9096a492cc2bcd91ef1e00bc89a8e762bc57fde2e0e849f5805e4bba19a6e83c526760a1b77fcc31ee0a8e7f35d64d5b75286480b46ad1b5b183294b6f3375fd7f025e36d6fe0fa032ba638b8be93b27864bedd8f34b1a5f2f55acac8601d0122d89499a5729e595d553333daefb6f4ef6eba3b571e8a017d6758fc71759", 0xe0}, 0x68) 18:18:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2170.419418] blktrace: Concurrent blktraces are not allowed on sg0 [ 2170.425012] blktrace: Concurrent blktraces are not allowed on sg0 [ 2170.428578] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2170.434905] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2170.434905] program syz-executor.0 not setting count and/or reply_len properly 18:18:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x4000, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000040)) read$hiddev(r1, &(0x7f0000000700)=""/68, 0x44) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) recvmmsg$unix(r1, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000780)=""/5, 0x5}, {&(0x7f00000007c0)=""/51, 0x33}, {&(0x7f0000000d40)=""/33, 0x21}, {&(0x7f0000000840)=""/166, 0xa6}, {&(0x7f0000000900)=""/196, 0xffffffffffffff12}, {&(0x7f0000001040)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/99, 0x6e}, {&(0x7f0000000a80)=""/153, 0xa6}], 0x8, &(0x7f00000021c0)=ANY=[@ANYBLOB="38000000000000000100000001000000", @ANYRES32=0xffffffffffffffff, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000f470ebf18b9d46bd1093d3265e4a745200126d88d108bbe41c14eb6eaae45eb7998b23f5392f7b850b4c86c950952dc7c2262cb9fd300e4f335363015e265efb4322e479cbac14b12d57e1c1d8546424f139f2d6777ffba48591494db333197c7fd99092b79b7bd8c88d1ce9b9d61e89f53351fbaff29064541c67ca34ad", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x78}}, {{&(0x7f0000000c40), 0x6e, &(0x7f0000000d00)=[{&(0x7f0000000cc0)=""/34, 0x22}], 0x1, &(0x7f0000000d40), 0xb0}}, {{&(0x7f0000000e00)=@abs, 0x6e, &(0x7f0000000e80)}}], 0x3, 0x10100, 0x0) r3 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x1000003, 0x3c2}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000d80), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r3}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)=0x0) clock_gettime(0x0, &(0x7f0000000800)={0x0, 0x0}) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000c00)=@IORING_OP_TIMEOUT={0xb, 0x4, 0x0, 0x0, 0x8, &(0x7f0000000bc0)={r5, r6+10000000}, 0x1, 0x1, 0x1, {0x0, r7}}, 0xfffffff8) syz_io_uring_setup(0x4c75, &(0x7f0000002040)={0x0, 0xe1c9, 0x20, 0x0, 0x249, 0x0, r3}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000e80), &(0x7f0000000fc0)) openat(r2, &(0x7f0000000f80)='./file0\x00', 0x200000, 0x2) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000680)={0x0, 0xfffffffffffffffc, 0xe1, 0x3f, @scatter={0x3, 0x0, &(0x7f0000000200)=[{&(0x7f0000000280)=""/134, 0x86}, {&(0x7f00000001c0)=""/28, 0x1c}, {&(0x7f0000000340)=""/201, 0xc9}]}, &(0x7f0000000440)="946867c4de019a82bb2f57e495b4974640e80c2030757ca19414d60fa4c00e9dfa23c8cadc809714d7d25d14b8028e0029d0f983512bc0ac354226741d50a2cf0adacbf723cd27b72062900781ba3280f85945bd4d5b23d8e671ec9e19797d9b17c1e32e7243751a174f259316107ad4c6fadaa11bfbdb244e2c7abf887a932e394cf5d59baac6fc80fdb479e205e2ae87438c8ba00bba26b7a2e48b22268045b6efa68687bf10b031835e3812c97ddcfccfaedd7a9617fade8684aea20e6b7268c95e697e96f7d8fde19f66c3f5e4ec46825e48c43513ca8f535955fd5581601d", &(0x7f0000000540)=""/219, 0x20, 0x4, 0x3, &(0x7f0000000640)}) [ 2170.458540] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2170.462446] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2170.462446] program syz-executor.1 not setting count and/or reply_len properly [ 2170.464712] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:18:57 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2170.484859] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:18:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:18:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) 18:18:57 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x9, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2170.574907] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2170.574907] program syz-executor.1 not setting count and/or reply_len properly 18:18:57 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xa00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:18:57 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:18:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:18:57 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:18:57 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x0, 0x10, r4, 0x27000000) [ 2170.707950] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO 18:18:57 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2170.725598] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2170.725598] program syz-executor.0 not setting count and/or reply_len properly [ 2170.757065] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:18:57 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) write$binfmt_aout(r0, &(0x7f0000000000)={{0x10b, 0x1, 0xff, 0x399, 0x109, 0xd499, 0x1dd, 0x9}, "5ef62a1adf568406ba9519fbfcbc5f71"}, 0x30) 18:18:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xe0403, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0xb7, 0x1, 0xca, "fff4f04ef5c68de341668bd7ee2afd1f1264b6dcb8d869f0257e35174d37bc95f28efde316cf7467d33b490cf05dfed700048fce18ee2ef90d933788ccbc9892e3a5a7bafe16de5e5a17b28da05c14d67c9997afc178df9c8b2660cf00797f05e02f75e06084b875f9c6a0274ab1f2893a9eccb855a3235f67cbcb7ddeacab9f68bee7e9593950b08ebb22ad89759a347085d0c9143e06418af37301988cf115fdd2baabddf238576aada81c586d9d4a8fca7906e34eb9"}) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) write(r0, &(0x7f0000000000)="70483584f2179bfdd25cbc5b957eb215a887b31eb17350afc1517c344caa4897f2", 0x21) [ 2170.821472] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:18:57 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:18:57 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xb00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2171.026951] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:19:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000002c0)) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xb3c, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2188.158751] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2188.162750] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2188.162750] program syz-executor.0 not setting count and/or reply_len properly 18:19:14 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:19:14 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:14 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r1, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$hiddev(r0, &(0x7f0000000040)=""/169, 0x200000e9) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r2, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:19:14 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xa, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:19:14 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:19:14 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000280)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7}}, './file0\x00'}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000440)={0x0, @adiantum, 0x0, @desc3}) write(0xffffffffffffffff, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f00000003c0)={0x53, 0xfffffffffffffffe, 0x0, 0x9, @scatter={0x0, 0x0, &(0x7f00000001c0)}, &(0x7f0000000280), &(0x7f00000002c0)=""/163, 0x8, 0x10032, 0x40, &(0x7f0000000380)}) 18:19:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) openat$zero(0xffffffffffffff9c, &(0x7f0000000280), 0x602242, 0x0) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:14 executing program 7: openat2$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x8}, 0x18) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000}, 0x0, 0x6, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_config_ext, 0x2002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000500), 0x6e, &(0x7f0000000c80)=[{&(0x7f0000000580)=""/61, 0x3d}, {&(0x7f00000005c0)=""/247, 0xf7}, {&(0x7f00000006c0)=""/131, 0x83}, {&(0x7f0000000980)=""/225, 0xe1}, {&(0x7f0000000a80)=""/179, 0xb3}, {&(0x7f0000000b40)=""/62, 0x3e}, {&(0x7f0000000b80)=""/180, 0xb4}, {&(0x7f0000000c40)=""/33, 0x21}], 0x8, &(0x7f0000000d00)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x10002) perf_event_open(&(0x7f0000000480)={0x0, 0x80, 0x0, 0x3, 0x5a, 0xfc, 0x0, 0x3f, 0x10400, 0xc, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x8, 0x0, @perf_bp={&(0x7f0000000440)}, 0x10002, 0xffffffffffffffff, 0x2, 0x9, 0x874, 0xff, 0x5, 0x0, 0x3, 0x0, 0x1}, r0, 0xf, 0xffffffffffffffff, 0x1) syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='hugetlbfs\x00', 0x0, 0x0) inotify_init1(0x0) pivot_root(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)) mount(&(0x7f0000000180)=@nullb, &(0x7f0000000200)='./file1\x00', &(0x7f0000000380)='logfs\x00', 0x2000000, &(0x7f00000003c0)='/dev/loop') dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r2 = gettid() setpriority(0x1, r2, 0x0) setpriority(0x3, r2, 0x1000) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x1f, 0x3, 0xdf, 0x2, 0x0, 0x8, 0xeae1dd00eb7d3d5c, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x2, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x4, @perf_bp, 0x300, 0x4487, 0x8, 0x8, 0x20, 0x8, 0xfb, 0x0, 0x5, 0x0, 0x101}, r2, 0x2, 0xffffffffffffffff, 0x8) 18:19:15 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2188.276815] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2188.281258] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2188.281258] program syz-executor.0 not setting count and/or reply_len properly [ 2188.281333] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2188.297284] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:19:15 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)={0x58, 0x2716, 0x8, "cbe542935cb2d5a8ae5d48557a06eaca609f383a7461ef249a71d28e8f26e36eeba2afcbba1d6c256ba8b7fdbc5b8036fb9d3b52ddbdf10bdb1becc67876d803f929ad9506611c13db23d3ca6eb00a9798e4aa4d708343d7"}) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:15 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:19:15 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2188.381426] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2188.385933] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2188.385933] program syz-executor.0 not setting count and/or reply_len properly 18:19:29 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_P2P_DEVICE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x6, 0x78}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0xc854}, 0xc081) 18:19:29 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:19:29 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xb, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:19:29 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:19:29 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:19:29 executing program 1: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:29 executing program 5: write(0xffffffffffffffff, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000280), 0x20002, 0x0) waitid$P_PIDFD(0x3, r1, &(0x7f0000000100), 0x2, &(0x7f0000000040)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="6669ec651800000000000000"]) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r4, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30c) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), r0) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x84000200}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, r5, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfff}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20008040}, 0x24000000) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r6, &(0x7f0000000540), 0x7, &(0x7f00000005c0)) ioctl$TUNSETLINK(r6, 0x400454cd, 0x30c) ioctl$TUNGETVNETHDRSZ(r6, 0x800454d7, &(0x7f0000000200)) dup(r3) sendfile(r0, 0xffffffffffffffff, &(0x7f0000000000)=0x8, 0xffff) [ 2202.710520] sg_write: data in/out 120144348/140 bytes for SCSI command 0xed-- guessing data in; [ 2202.710520] program syz-executor.0 not setting count and/or reply_len properly 18:19:29 executing program 0: write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2202.740356] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:19:29 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0xfffffffffffffffc, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:19:29 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:19:29 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2202.817563] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2202.975814] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:19:46 executing program 7: r0 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) r1 = syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r0}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x1000)=nil, 0x1000, 0x2, 0xcadaaffd468f3732, r0, 0x0) syz_io_uring_setup(0x227d, &(0x7f0000000040)={0x0, 0x2bd7, 0x10, 0x0, 0x5, 0x0, r1}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) r4 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x2, 0x1cb, 0x0, r4}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) syz_io_uring_submit(r2, r3, &(0x7f0000000140)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r4}, 0x3) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000000000)) r5 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r5, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) 18:19:46 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:46 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xd, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:19:46 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r1, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$hiddev(r0, &(0x7f0000000040)=""/169, 0x200000e9) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r2, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:19:46 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, 0xffffffffffffffff, 0x27000000) 18:19:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xd00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:19:46 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:19:46 executing program 0: write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2220.174697] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:19:46 executing program 0: write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:46 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:46 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, 0xffffffffffffffff, 0x27000000) [ 2220.244849] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:19:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xe00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:19:47 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:19:47 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:47 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xe, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2220.356742] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:19:47 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r1, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$hiddev(r0, &(0x7f0000000040)=""/169, 0x200000e9) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r2, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:19:47 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) write$binfmt_aout(r0, &(0x7f0000000000)={{0x10b, 0x1, 0xff, 0x399, 0x109, 0xd499, 0x1dd, 0x9}, "5ef62a1adf568406ba9519fbfcbc5f71"}, 0x30) 18:19:47 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:47 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:19:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xec0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:19:47 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:19:47 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) write$binfmt_aout(r0, &(0x7f0000000000)={{0x10b, 0x1, 0xff, 0x399, 0x109, 0xd499, 0x1dd, 0x9}, "5ef62a1adf568406ba9519fbfcbc5f71"}, 0x30) [ 2220.562936] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2220.575243] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:20:04 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, 0xffffffffffffffff, 0x27000000) 18:20:04 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:20:04 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r1, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$hiddev(r0, &(0x7f0000000040)=""/169, 0x200000e9) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r2, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:04 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xf00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:04 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) write$binfmt_aout(r0, &(0x7f0000000000)={{0x10b, 0x1, 0xff, 0x399, 0x109, 0xd499, 0x1dd, 0x9}, "5ef62a1adf568406ba9519fbfcbc5f71"}, 0x30) 18:20:04 executing program 0: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:20:04 executing program 1: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:20:04 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xf, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2237.961868] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2237.979864] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2237.984736] perf: interrupt took too long (6250 > 6237), lowering kernel.perf_event_max_sample_rate to 32000 18:20:19 executing program 1: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:20:19 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x0) 18:20:19 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x9, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:19 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:20:19 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r1, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$hiddev(r0, &(0x7f0000000040)=""/169, 0x200000e9) write(0xffffffffffffffff, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:19 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x10, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x3c0b, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:20:19 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r1, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$hiddev(r0, &(0x7f0000000040)=""/169, 0x200000e9) write(0xffffffffffffffff, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) [ 2253.210943] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:20:19 executing program 1: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2253.220527] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.7'. 18:20:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2253.258837] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:20:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r1, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read$hiddev(r0, &(0x7f0000000040)=""/169, 0x200000e9) write(0xffffffffffffffff, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:20 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) 18:20:20 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:20:20 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x300, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:20 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x0) 18:20:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc00e, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2253.439780] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2253.509875] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:20:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) 18:20:38 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x0) 18:20:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x1a000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:38 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:20:38 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:20:38 executing program 5: syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r0, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:38 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000240)="32999a17616cc86e4b4f757dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5487978d4546919d06bd9e", 0x30) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r3, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r3, 0x400454cd, 0x30c) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) 18:20:38 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x500, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:38 executing program 5: syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r0, 0xee01, 0xffffffffffffffff) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) [ 2272.087740] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2272.099786] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:20:38 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:20:38 executing program 7: syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r0, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:38 executing program 0: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:20:38 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x600, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:20:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x34000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:39 executing program 5: syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:39 executing program 0: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) [ 2272.321814] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:20:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:20:39 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2272.382750] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:20:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x40000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:53 executing program 7: syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r0, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:53 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x700, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:20:53 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:20:53 executing program 0: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe7521310fc01f0b3e49a4e567241074de1f6bb18ee997eaf1c8e3421776fbf05977f808572dfc9b8081f0e5fc2227521c3d88970899bc05faccd8e8744735dfb81edbeb080eb3ef28a17a7e320dad9fa20bead0136f24cd8e89ccf9720538", 0xbc) 18:20:53 executing program 5: syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:20:53 executing program 3: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000}, 0x20) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:20:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:20:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) 18:20:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) [ 2287.094259] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2287.098173] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:21:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe", 0x5e) 18:21:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x80000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:08 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x900, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) 18:21:08 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:21:08 executing program 7: syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) fchown(r0, 0xee01, 0xffffffffffffffff) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r1, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:21:08 executing program 5: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:21:08 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) (fail_nth: 1) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2301.646498] FAULT_INJECTION: forcing a failure. [ 2301.646498] name failslab, interval 1, probability 0, space 0, times 0 [ 2301.647670] CPU: 1 PID: 10795 Comm: syz-executor.3 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2301.648232] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2301.648764] Call Trace: [ 2301.648956] [ 2301.649127] dump_stack_lvl+0x8f/0xb7 [ 2301.649410] should_fail_ex.cold+0x5/0xa [ 2301.649712] should_failslab+0x9/0x20 [ 2301.649990] __kmem_cache_alloc_node+0x5b/0x400 [ 2301.650326] ? kobject_uevent_env+0x23a/0xfa0 [ 2301.650652] kmalloc_trace+0x26/0x60 [ 2301.650917] kobject_uevent_env+0x23a/0xfa0 [ 2301.651217] ? __pfx_dev_uevent_name+0x10/0x10 [ 2301.651536] ? is_acpi_device_node+0x72/0x90 [ 2301.651854] device_del+0x9e1/0xfd0 [ 2301.652133] ? __pfx_device_del+0x10/0x10 [ 2301.652433] ? device_unregister+0xd/0x30 [ 2301.652724] device_unregister+0x15/0x30 [ 2301.653033] bdi_unregister+0x3ec/0x5b0 [ 2301.653316] ? __pfx_bdi_unregister+0x10/0x10 [ 2301.653639] ? up_write+0x1b0/0x520 [ 2301.653921] del_gendisk+0x856/0xa70 [ 2301.654194] loop_control_ioctl+0x455/0x620 [ 2301.654510] ? __pfx_loop_control_ioctl+0x10/0x10 [ 2301.654848] ? selinux_file_ioctl+0xb5/0x260 [ 2301.655166] ? __pfx_loop_control_ioctl+0x10/0x10 [ 2301.655500] __x64_sys_ioctl+0x19e/0x210 [ 2301.655804] do_syscall_64+0x3f/0x90 [ 2301.656087] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2301.656472] RIP: 0033:0x7f8516844b19 [ 2301.656748] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2301.658049] RSP: 002b:00007f8513dba188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2301.658596] RAX: ffffffffffffffda RBX: 00007f8516957f60 RCX: 00007f8516844b19 [ 2301.659100] RDX: 0000000000000000 RSI: 0000000000004c81 RDI: 0000000000000004 [ 2301.659603] RBP: 00007f8513dba1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2301.660116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2301.660625] R13: 00007ffce7fe0e6f R14: 00007f8513dba300 R15: 0000000000022000 [ 2301.661160] [ 2301.689755] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2301.691898] sg_write: data in/out 120144348/46 bytes for SCSI command 0xed-- guessing data in; [ 2301.691898] program syz-executor.1 not setting count and/or reply_len properly [ 2301.732121] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:21:08 executing program 5: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:21:08 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xa00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) 18:21:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:21:08 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) (fail_nth: 2) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:21:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x400300, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:08 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:21:08 executing program 7: openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) syz_mount_image$tmpfs(&(0x7f00000000c0), &(0x7f0000000000)='./file1\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6d706f6c3d69119a65eeaad23ffa2b8cdb6e7465726c656176653d7374617469632c00"]) [ 2301.890569] tmpfs: Bad value for 'mpol' [ 2301.906716] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:21:08 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:21:08 executing program 7: ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, &(0x7f0000000240)=0x5) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5060}, 0x4000, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x2) prctl$PR_SET_DUMPABLE(0x4, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x2) keyctl$clear(0x7, 0xfffffffffffffffa) r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$get_persistent(0x16, 0x0, r0) getpriority(0x2, 0x0) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000580), 0x400, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffffc) sync() setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4) sendmsg$IEEE802154_LLSEC_SETPARAMS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r1, 0x20, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x5f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x60000000}, 0x4004) 18:21:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) [ 2301.952514] FAULT_INJECTION: forcing a failure. [ 2301.952514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2301.953631] CPU: 1 PID: 10828 Comm: syz-executor.3 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2301.954191] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2301.954739] Call Trace: [ 2301.954921] [ 2301.955086] dump_stack_lvl+0x8f/0xb7 [ 2301.955374] should_fail_ex.cold+0x5/0xa [ 2301.955674] _copy_from_user+0x2e/0x180 [ 2301.955962] kstrtouint_from_user+0xb0/0x170 [ 2301.956286] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 2301.956645] ? lock_acquire.part.0+0x12e/0x340 [ 2301.956996] proc_fail_nth_write+0x7c/0x220 [ 2301.957305] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2301.957654] ? lock_is_held_type+0xdb/0x130 [ 2301.957965] vfs_write+0x2cf/0xd90 [ 2301.958236] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2301.958582] ? __pfx_vfs_write+0x10/0x10 [ 2301.958876] ? __fget_files+0x270/0x450 [ 2301.959190] ksys_write+0x12b/0x260 [ 2301.959461] ? __pfx_ksys_write+0x10/0x10 [ 2301.959762] ? syscall_enter_from_user_mode+0x21/0x50 [ 2301.960124] ? syscall_enter_from_user_mode+0x21/0x50 [ 2301.960493] do_syscall_64+0x3f/0x90 [ 2301.960770] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2301.961150] RIP: 0033:0x7f85167f75ff [ 2301.961418] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 2301.962607] RSP: 002b:00007f8513d99170 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2301.963127] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85167f75ff [ 2301.963606] RDX: 0000000000000001 RSI: 00007f8513d991e0 RDI: 0000000000000005 [ 2301.964083] RBP: 00007f8513d991d0 R08: 0000000000000000 R09: 0000000000000000 [ 2301.964557] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 2301.965040] R13: 00007ffce7fe0e6f R14: 00007f8513d99300 R15: 0000000000022000 [ 2301.965564] 18:21:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:21:08 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xb00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:08 executing program 5: r0 = syz_open_dev$sg(0x0, 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) [ 2302.024139] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:21:08 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2302.115499] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:21:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xa00100, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:23 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:21:23 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:21:23 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:21:23 executing program 7: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_config_ext, 0x2002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='hugetlbfs\x00', 0x0, 0x0) pivot_root(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r3 = getuid() fsetxattr$system_posix_acl(r2, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [{}, {0x2, 0x1, r3}, {0x2, 0x4}], {}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x3c, 0x0) epoll_create1(0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder-control\x00', 0x400, 0x0) pivot_root(&(0x7f0000000140)='./file1\x00', &(0x7f00000001c0)='./file1\x00') openat(r1, &(0x7f0000000380)='./file0\x00', 0x4000, 0x161) socket$inet6_udplite(0xa, 0x2, 0x88) setxattr$security_capability(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300), &(0x7f0000000340)=@v3={0x3000000, [{0x6, 0x1ff}, {0x0, 0x5b}], r3}, 0x18, 0x4) fork() ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r2, 0xc0189373, &(0x7f0000005d80)=ANY=[@ANYBLOB="010000220100000018000000", @ANYRES32=r0, @ANYBLOB="050000000000000000"]) 18:21:23 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:21:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:21:23 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xb24, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2316.778884] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2316.779856] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:21:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f550", 0x2f) 18:21:39 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:21:39 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x2, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:21:39 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:21:39 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:21:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x1000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:39 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:39 executing program 7: pwritev(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x77, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r1 = syz_io_uring_setup(0x221b, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x1, 0x157}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000002040), &(0x7f0000002080)) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000480), r1) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x58, r2, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x432}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFINDEX={0x8}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_FLAGS={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x24004890}, 0x44) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r1}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) fallocate(r1, 0x3, 0xb67c, 0x3) syz_io_uring_setup(0x1bd8, &(0x7f0000000000)={0x0, 0xc423, 0x8, 0x0, 0x50, 0x0, r0}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000002c0), 0x44000, 0x0) syz_io_uring_setup(0xcff, &(0x7f0000000300)={0x0, 0xf770, 0x2, 0x1, 0x290, 0x0, r4}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000008, 0x100010, r0, 0x10000000) r6 = socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000280)=@IORING_OP_READV=@pass_iovec={0x1, 0x3, 0x2000, @fd=r6, 0x5, &(0x7f0000000240)=[{&(0x7f0000000200)=""/26, 0x1a}], 0x1, 0x0, 0x1}, 0xa77e) 18:21:39 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3abf49211a2e6f5278a3697202000000af2ed5a70e97adfe", 0x5e) 18:21:39 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) [ 2332.597909] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:21:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f550", 0x2f) [ 2332.607838] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:21:39 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2332.676593] sg_write: data in/out 120144348/46 bytes for SCSI command 0xed-- guessing data in; [ 2332.676593] program syz-executor.0 not setting count and/or reply_len properly 18:21:39 executing program 7: accept4$packet(0xffffffffffffffff, &(0x7f0000001b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, 0x0, &(0x7f00000000c0)) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000100)={@empty, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3, 0x4649, 0x1, 0x200, 0x95, 0x10200, r0}) r3 = syz_open_dev$vcsa(&(0x7f0000001c80), 0x496, 0x400) socket$inet_icmp(0x2, 0x2, 0x1) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r3, 0xc0189379, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0), 0x0, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @broadcast}}}], 0x20}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r5, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000400)=ANY=[@ANYRES32=r6]}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b80)={&(0x7f00000008c0)=ANY=[@ANYBLOB="94020000", @ANYRES16=0x0, @ANYBLOB="00022abd7000fddbdf25060000000c00018008000100", @ANYRES32=0x0, @ANYBLOB="6000018008000300010000000800030002000000140002006d61637674617030000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468300000000000000000000000140002007663616e30000000000000000000000068000180080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="7015374a", @ANYRES32=0x0, @ANYBLOB="08000300050000001400020076657468300000000000000000000000140002006970366772653000000000000000000008000100", @ANYRES32=r0, @ANYBLOB="1400020069703667726574617030000000000000400001801400020069703665727370616e3000000000000008000300010000000800030002000000080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="0800030003000000700001800800030001000000080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000001400020069705f76746930000000000000000000140002006261746164765f736c6176655f30000014000200776c616e300000000000000000000000080003000000000008000300020000005400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r0, @ANYBLOB="080003000200000008000100", @ANYRES32=r0, @ANYBLOB="14000200766c616e300000000000000000000000140002006e723000000000000000000000000000a8000180080003000300000014000200766c616e310000000000000000000000140002006d6163766c616e310000000000000000140002006261746164765f736c6176655f3000001400020076657468315f746f5f7465616d0000001400020076657468315f746f5f7465616d000000140002006e723000000000000000000000000000080003000300000008000100", @ANYRES32=r6, @ANYBLOB="1400020076657468315f746f5f7465616d000000"], 0x294}, 0x1, 0x0, 0x0, 0x404c000}, 0x40080) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x0, 0x0}) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x0, 0x0) 18:21:39 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xd00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x2000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:39 executing program 5: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:21:39 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:21:39 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:21:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f550", 0x2f) [ 2332.861069] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:21:39 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4b47, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:21:39 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:21:39 executing program 5: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) [ 2332.913785] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:21:39 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x0, 0x0, 0x60, 0x69, 0x0, 0x81, 0x8001a, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x3, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x15cf, 0x4, @perf_config_ext={0x7, 0x7}, 0x40108, 0x2, 0xfffffffa, 0x9, 0xfffffffffffffff9, 0x7ff, 0x58, 0x0, 0x3, 0x0, 0x4}, 0xffffffffffffffff, 0xa, r0, 0x2) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x3a57}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000640)={0x127363500, &(0x7f00000000c0), 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcf9}, 0x58) ioctl$F2FS_IOC_FLUSH_DEVICE(0xffffffffffffffff, 0x4008f50a, &(0x7f0000000000)) syz_open_dev$usbmon(&(0x7f0000000200), 0x0, 0x511000) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) 18:21:39 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xe00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3a", 0x47) [ 2333.034677] sg_write: data in/out 120144348/23 bytes for SCSI command 0xed-- guessing data in; [ 2333.034677] program syz-executor.1 not setting count and/or reply_len properly [ 2333.130454] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:21:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x3000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:56 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xec0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:56 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4b49, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:21:56 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_config_ext, 0x2002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='hugetlbfs\x00', 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x40000020) pivot_root(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='./file0\x00') unlink(0x0) lstat(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)) setxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140), &(0x7f00000001c0)=@v3={0x3000000, [{}, {0xffffffff}], r1}, 0x18, 0x0) pwrite64(r0, &(0x7f0000000780)="75c5d2f2aa03f05d254d5e1c670541bfe919ae6a6d92c416fc85b2f43b461d5c83e12a951001fcb3fc88dfa2494f68576a77bd0b08b9", 0x36, 0x8) mount(&(0x7f0000000180)=ANY=[@ANYBLOB="2f2ec56eb5000000380047ac85f3a100000000eff3a73a7ed7a5668bc5ef08ff"], &(0x7f00000008c0)='./file1\x00', &(0x7f0000000900)='ceph\x00', 0x0, &(0x7f0000000940)='system.posix_acl_access\x00') dup2(0xffffffffffffffff, 0xffffffffffffffff) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000300)) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000240)={0xd0002006}) 18:21:56 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:21:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0), 0x0) 18:21:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503b", 0x30) 18:21:56 executing program 5: syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(0xffffffffffffffff, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c67962a26274040bcffd4d5b05797b855a7b657f720ba6a043e335e013016128a9a3487db439e47ee494ad526ee40242bff175a4acb2d12f560eadad7c5cc32f30fd0ffa1a68bebdde705ca146f", 0x97) 18:21:56 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2349.648761] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2349.718739] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:21:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x4000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:21:56 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2349.866216] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:22:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503b", 0x30) 18:22:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f550", 0x2f) 18:22:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x5000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:22:14 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:22:14 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c80, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:22:14 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xf00, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:22:14 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503b", 0x30) 18:22:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) 18:22:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) 18:22:14 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503b", 0x30) 18:22:14 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f550", 0x2f) [ 2367.555357] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2367.576382] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:22:14 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:22:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, 0x0, 0x0) 18:22:14 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x121042, 0x0) pwritev(r0, &(0x7f0000001440)=[{&(0x7f0000000200)="5485fb8bf00b4bef4c264161b749ba1542d210f54a83775bfe8da884e8da61c18e3c60d2355fd6bd5d57dede63d7a0cee19f4b6d3c163a9c6e7012eff9c2cb4e9cff11016c12ec46fdfa6a790dc6aec72d9de26cdf16", 0x56}], 0x1, 0xffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0xfffffffffffffffe}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r4, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r4, 0x400454cd, 0x30c) mmap$perf(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xa, 0x10, r4, 0x9) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000900)={0x4, 0x1c000000000, 0x7, 0x0, 0x0, [{{}, 0xff}, {{r1}, 0x2}, {{r3}, 0x9}, {{}, 0x7}, {}, {{}, 0x8}, {{r3}, 0x6}]}) sendfile(r1, r1, 0x0, 0x100000) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r6 = syz_mount_image$msdos(&(0x7f0000000300), &(0x7f0000000340)='./file1/file0\x00', 0xffffffffffffff57, 0x6, &(0x7f0000000700)=[{&(0x7f0000000380)="3eb6ca71011ce865653c68c58f4bedb6270a65f6bce8c744f7394823a37b49bbc2e4e2db6cd3bf66795f668919e75cb2bd12ee4fa48ad879b5cc19b0327a824b5a9cd39c1f3342c6b80518544c01cd4be24cb878f9b0c80e22d4fa1c9babf22d96e3bd5f455fc638346c1dbc943b4dee0185ce65b1f58fed48cf458e1677b2815d1d296712f2537910fcbe8cd1b51650ef", 0x91, 0x2}, {&(0x7f0000000440)="c6fd292002487764eb436beca85624e9757870ad6a0ce6ca373bdd028a11ff6152adca51b0e758cf9c3f82c82374ccfe53f136159332b4c254b839e5c3bf3531d558efd095e69a7d285b5d1addb99b9edee5a73731ad7aef874973b484eb3237818248480197a98b6be064129ff10e90d70572659ef4574f1ebda5895186fc012920be49e417ff8967f13ce339ff962ddfee8eea47784b43de10e3e7f1e2f33754c3c1922970e4", 0xa7, 0x20}, {&(0x7f0000000500)="02bf2980b32e95ea688b0c177300ea628330425a01a1003ab15d28c161fdec73387b24b8bd8e143404b1070039d8d3d58ccc5a6b0e30b3317b0c9cb664a5fe1eaabc546d3e49801dfcd2c81a99292e64ba491b3c4ac9cee8657bb8655c29a465f5311b36435a642500da7ae18f1ebe92ce1d39b28c97847bfd7895043f202a29c55e47ff927a40b2e77d1a6f233f60527ec2846faaa4b232f932c627", 0x9c, 0x8}, {&(0x7f00000005c0)='I', 0x1, 0x3f}, {&(0x7f0000000600)="384d926288315238076a37bd61226e71d7fb90230c6801df58285e32442165c0d91a6e0575ca70642383e007e2d16aa3190b15844f1526a5d7c85b714c26ef04090e708ca9ecebb94562ef0ed8616049c0ad21063e0051a07f107386adcf606289af79efc247af1176bfd4a032fd0e345c66509eecf6d2a6ee5827451654e5aa2941e3ac819fc8340749d718e78c74d3f93e4d34f25574536be271", 0x9b, 0x3}, {&(0x7f00000006c0)="b3eac36d87e8c195dab9d06fe74ddcf0e66ad39d683d1815b1351df3b216", 0x1e, 0x1000}], 0x801, &(0x7f00000007c0)={[{@dots}, {@dots}, {@fat=@nfs_nostale_ro}, {@fat=@discard}, {@nodots}, {@dots}, {@dots}, {@dots}, {@nodots}], [{@uid_eq}, {@context={'context', 0x3d, 'sysadm_u'}}, {@obj_user={'obj_user', 0x3d, '\''}}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/hpet\x00'}}]}) openat(r6, &(0x7f0000000880)='./file1\x00', 0xc041, 0x4) fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000180), &(0x7f00000001c0)={'U-', 0x8}, 0x16, 0x1) pwritev(r5, &(0x7f0000000080)=[{&(0x7f0000000140)='\x00', 0x1a}], 0x1, 0x7fffffc, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0xa981, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {0x2}}, './file1\x00'}) fcntl$dupfd(r7, 0x406, r8) 18:22:14 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c82, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:22:14 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x240b, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:22:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x6000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2367.823631] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2367.828595] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:22:29 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f550", 0x2f) 18:22:29 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc00e, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:22:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x7000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:22:29 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x541b, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:22:29 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000), 0x0) 18:22:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd", 0x3c) 18:22:29 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:22:29 executing program 7: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x100000, &(0x7f0000000180)=ANY=[@ANYBLOB="6e0010cbccab4412fc070000", @ANYRESDEC]) r1 = signalfd(r0, &(0x7f0000000080)={[0x1000]}, 0x8) unlink(&(0x7f0000000140)='./file0\x00') openat(r1, &(0x7f0000000100)='./file0\x00', 0x149441, 0x8) [ 2382.527776] sg_write: data in/out 120144348/12 bytes for SCSI command 0xed-- guessing data in; [ 2382.527776] program syz-executor.1 not setting count and/or reply_len properly 18:22:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2", 0x31) 18:22:29 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:22:29 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd8d4b1425ba2d0e0b558a3a", 0x47) [ 2382.578721] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2382.583866] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2382.611621] sg_write: data in/out 120144348/1 bytes for SCSI command 0xed-- guessing data in; [ 2382.611621] program syz-executor.1 not setting count and/or reply_len properly 18:22:29 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000), 0x0) 18:22:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2", 0x31) 18:22:29 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x1a000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:22:29 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x6000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2382.703639] sg_write: data in/out 120144348/23 bytes for SCSI command 0xed-- guessing data in; [ 2382.703639] program syz-executor.0 not setting count and/or reply_len properly 18:22:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x8000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:22:29 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503b", 0x30) 18:22:29 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2382.786442] sg_write: data in/out 120144348/1 bytes for SCSI command 0xed-- guessing data in; [ 2382.786442] program syz-executor.1 not setting count and/or reply_len properly [ 2382.805095] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.7'. 18:22:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2", 0x31) 18:22:29 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000), 0x0) 18:22:29 executing program 7: r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x2, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[]) r1 = memfd_secret(0x80000) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000017c0)={'dummy0\x00', &(0x7f0000001780)=@ethtool_pauseparam={0x12, 0xffff7fff, 0x8, 0x7ff}}) chdir(&(0x7f0000000140)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) openat(0xffffffffffffffff, &(0x7f0000000340)='./file0/file0\x00', 0x100, 0x0) mount_setattr(0xffffffffffffffff, &(0x7f00000001c0)='./file0/file0\x00', 0x100, &(0x7f0000000240)={0x100008, 0x0, 0x100000}, 0x20) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) renameat(r0, &(0x7f0000000180)='./file0/file0\x00', 0xffffffffffffffff, &(0x7f0000001880)='./file0\x00') perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001700)=[{&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/210, 0xd2}, {&(0x7f0000001480)=""/79, 0x4f}, {&(0x7f0000001500)=""/104, 0x68}, {&(0x7f0000001580)=""/222, 0xde}, {&(0x7f0000001680)=""/110, 0x6e}], 0x6, 0x1000, 0x5) preadv(r0, &(0x7f0000001840)=[{&(0x7f0000001800)=""/22, 0x16}], 0x1, 0x2, 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) ioctl$FAT_IOCTL_GET_VOLUME_ID(0xffffffffffffffff, 0x80047213, &(0x7f0000000300)) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) fallocate(r3, 0x0, 0x9, 0x8001) sendfile(r3, r2, 0x0, 0xfffffdef) [ 2382.892601] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2382.901049] sg_write: data in/out 120144348/1 bytes for SCSI command 0xed-- guessing data in; [ 2382.901049] program syz-executor.1 not setting count and/or reply_len properly [ 2382.954864] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:22:46 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x2, 0x1, &(0x7f0000001f00)=[{0x0, 0x0, 0x100000000}]) syz_mount_image$nfs(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x2, 0x2, &(0x7f0000000280)=[{&(0x7f0000000100)="65c336baf38ed2ca051246e774c37fcf86c85c2861b07c5dd454a3f15889cab69a1289d5f573cd9643c1f6aba34c16c148ade66cdcae1652f0dcaff115c7d4f4df8d6b32188231da6623cb4b9ea9022cd3217db6bddb2f873b6729ffd83a2c078ee8101e81b00ee02f32ef0bf78cd88f9e688d2735", 0x75, 0xfffffffffffffa6a}, {&(0x7f0000000180)="cfdbb1162378427d4ab46077406ec829ffe367a71ef2080d430e17591951526a16f69960024fb2ad7b13a7d6ec54e6ad44b29a7ed8d5e49e3cf416473c5872bc4fc38a92c9e7f5b661ae396a7f1bbed86565f0870d0343d58b8c75a431dc0d1503d9f3b25a6e2ead1167782b1de0734a460681b3da250b409276ddc932a6bc29ba9857ab3f2c72e3529ceb2d651575b0f2ca8a1441fb41b7d2008464b08d6ddee9ec652c636201d9c3a05da013eaafd9d744833d60a93ac928de6a5dc42e949d550959e6309b251993a13a3cbe5fb2802ff9af107c6ee402d9e9930db2f7a6010878", 0xe2, 0x2}], 0x1200800, &(0x7f0000000480)=ANY=[@ANYBLOB="817d2b2c24275ec17b8e5e245c2a2c232c2c2d402c297e405e6469742c6673636f6e746578743d73746166665f752c7375626a5f726f6c653d242c7375626a5f747970653d2c61706072616973655f747970653d696d617369672c6f626a5f757365723d322d2d2c5c242c7375626a5f747970653d7d2c0039f022043956e96eff704ab96d20735a9982d496229954b840b189a155377af8da9869976d651f7e1a20bc1c5e0d267d82ae4ba39c02bac247277c91a13933da3f4f1fef32fff1434d6cc1e3b1a9a55a869f02826a4087eeb5deb6b3a0d2000000000000000038ea1420d108d031c72cc965a001ceb5508f5de6d2b0ee57a84d3d214f986e3b74c4f3b300d6b466e07d8c56a5c8a004f0873de62cd6e9f4565f0ff95157315455fef74de6ca568dacdf667e03614166b821ab126c0d6afcfb9bd8f02c7a7c3fecf52724c51be4871f4bae517062258ac7b7aad99d40c3b8257751dac827909fb08166a78469e370e1d278354e20c27dd7ed5b785df7d9e664fa405deb9e9e18e12cd6c3e51d8f6b089f4c307e21118b39e19110b36dd865dfca44dfd04ecb46a6"]) 18:22:46 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:22:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x9000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:22:46 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503b", 0x30) 18:22:46 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x5450, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:22:46 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2114485", 0x37) 18:22:46 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e57c1d2c40c43ec34beaa1b2ed4cc8232c6796", 0x4c) 18:22:46 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x34000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2399.498093] sg_write: data in/out 120144348/7 bytes for SCSI command 0xed-- guessing data in; [ 2399.498093] program syz-executor.1 not setting count and/or reply_len properly 18:22:46 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe", 0x32) [ 2399.548944] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2399.553844] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2399.577567] sg_write: data in/out 120144348/2 bytes for SCSI command 0xed-- guessing data in; [ 2399.577567] program syz-executor.1 not setting count and/or reply_len properly 18:23:03 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:23:03 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x5451, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:23:03 executing program 7: io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x44, 0x0, "704f5992d666aa2888e479ca552ee155f638582a91ca97213cf4774a2e4c350cdc3f9f62a4c21970bd149a52fa311b916bf00b51b808c412ed6b9fcbb5be4a2fb7dd8fd0dfa22b4100"}, 0xd8) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000018c0)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) socket$unix(0x1, 0x5, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) ioctl$CDROMREADTOCENTRY(0xffffffffffffffff, 0x125d, &(0x7f0000000000)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) fallocate(r1, 0x0, 0x0, 0x87ffffc) 18:23:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe", 0x32) 18:23:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503b", 0x30) 18:23:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)='2', 0x1) 18:23:03 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x40000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xa000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2416.997776] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:23:03 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x5452, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:23:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211448516dbb297cd", 0x3c) [ 2417.046073] sg_write: data in/out 120144348/2 bytes for SCSI command 0xed-- guessing data in; [ 2417.046073] program syz-executor.1 not setting count and/or reply_len properly 18:23:03 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x80000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2417.115213] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:23:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)='2', 0x1) [ 2417.140651] sg_write: data in/out 120144348/12 bytes for SCSI command 0xed-- guessing data in; [ 2417.140651] program syz-executor.0 not setting count and/or reply_len properly 18:23:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe", 0x32) 18:23:03 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x5460, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:23:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2", 0x31) [ 2417.194767] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:23:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xb000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2417.267245] sg_write: data in/out 120144348/1 bytes for SCSI command 0xed-- guessing data in; [ 2417.267245] program syz-executor.0 not setting count and/or reply_len properly 18:23:04 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:23:04 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x400300, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:04 executing program 7: shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmat(0x0, &(0x7f0000ff3000/0x4000)=nil, 0x4000) shmctl$IPC_STAT(0x0, 0x2, &(0x7f0000000140)=""/237) shmat(0x0, &(0x7f0000ff7000/0x1000)=nil, 0x4000) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$IPC_RMID(0xffffffffffffffff, 0x0) finit_module(r0, 0x0, 0x0) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x1b}, 0x18) r1 = shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ff8000/0x4000)=nil) shmat(r1, &(0x7f0000ffc000/0x4000)=nil, 0xcf3caed3d8c7cb92) fcntl$getown(0xffffffffffffffff, 0x9) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f0000000340)=""/95) shmctl$IPC_RMID(r1, 0x0) r2 = shmget$private(0x0, 0x1000, 0x800, &(0x7f0000ffc000/0x1000)=nil) shmat(r2, &(0x7f0000ff5000/0x3000)=nil, 0x2000) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x20001, 0x0) ioctl$SNAPSHOT_FREE(r3, 0x3305) shmget$private(0x0, 0x3000, 0x400, &(0x7f0000ff2000/0x3000)=nil) 18:23:04 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2", 0x31) 18:23:04 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x40049409, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2417.349569] sg_write: data in/out 120144348/2 bytes for SCSI command 0xed-- guessing data in; [ 2417.349569] program syz-executor.1 not setting count and/or reply_len properly [ 2417.397877] sg_write: data in/out 120144348/1 bytes for SCSI command 0xed-- guessing data in; [ 2417.397877] program syz-executor.0 not setting count and/or reply_len properly [ 2417.431825] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2417.475327] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:23:21 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)='2', 0x1) 18:23:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:21 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:23:21 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x40086602, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:23:21 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2", 0x31) 18:23:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211", 0x35) 18:23:21 executing program 7: shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmat(0x0, &(0x7f0000ffd000/0x1000)=nil, 0x5000) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) mmap$perf(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x110, 0xffffffffffffffff, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x44, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) getdents(0xffffffffffffffff, &(0x7f0000001680)=""/87, 0x57) mmap$perf(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000004, 0x10, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) perf_event_open(&(0x7f00000001c0)={0x1, 0xc7, 0x3c, 0x2, 0x4, 0x15, 0x0, 0x0, 0x1100, 0x5, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_bp={&(0x7f0000000180), 0xa}, 0x1000, 0x7, 0x3b, 0x2, 0x1ff, 0x20, 0x0, 0x0, 0xffffff7f, 0x0, 0x3}, 0x0, 0xb, 0xffffffffffffffff, 0x8) r3 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r3, &(0x7f0000ff2000/0x3000)=nil, 0x2000) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x5, 0x7f, 0x2, 0x0, 0x0, 0x4, 0x8000, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x4, @perf_bp={&(0x7f0000000000), 0x4}, 0x40418, 0xfffffffffffffffa, 0x7, 0x0, 0x7fff, 0xa44, 0x62, 0x0, 0x1, 0x0, 0x4b5c}, 0x0, 0x6, r0, 0x2) shmget$private(0x0, 0x3000, 0x200, &(0x7f0000ffb000/0x3000)=nil) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000240), 0x80800) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wg2\x00'}) 18:23:21 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xa00100, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2435.033606] sg_write: data in/out 120144348/5 bytes for SCSI command 0xed-- guessing data in; [ 2435.033606] program syz-executor.1 not setting count and/or reply_len properly 18:23:21 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486", 0x27) 18:23:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) [ 2435.093062] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2435.104048] sg_write: data in/out 120144348/1 bytes for SCSI command 0xed-- guessing data in; [ 2435.104048] program syz-executor.0 not setting count and/or reply_len properly [ 2435.110848] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:23:21 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2435.157941] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2435.157941] program syz-executor.1 not setting count and/or reply_len properly 18:23:21 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x1000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xd000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:21 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2114485", 0x37) 18:23:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:23:21 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x40087602, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:23:21 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486", 0x27) [ 2435.267617] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2435.267617] program syz-executor.1 not setting count and/or reply_len properly [ 2435.301869] sg_write: data in/out 120144348/7 bytes for SCSI command 0xed-- guessing data in; [ 2435.301869] program syz-executor.0 not setting count and/or reply_len properly [ 2435.308867] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2435.314409] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:23:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xe000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:40 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:23:40 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486", 0x27) 18:23:40 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:23:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:23:40 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe", 0x32) 18:23:40 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x2000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:40 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x401c5820, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:23:40 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0)}, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0xc) r1 = perf_event_open(&(0x7f0000000200)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x19088, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xe, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r1) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0)}, 0x0, 0x2, 0x20, 0x0, 0x0, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000480)='./file1/file0\x00', 0x345042, 0x1b8) waitid$P_PIDFD(0x3, 0xffffffffffffffff, &(0x7f0000000540), 0x2, &(0x7f00000005c0)={{}, {0x0}}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x1, 0x1f, 0x48, 0x9, 0x0, 0x10000, 0x40, 0xa, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x7ff, 0xdf5f461fc86e53c3, @perf_bp={&(0x7f00000003c0), 0x4}, 0x10400, 0x8, 0x49f5, 0x9, 0x7, 0x4, 0x4, 0x0, 0x8000, 0x0, 0xfff}, r0, 0xf, 0xffffffffffffffff, 0x9) r5 = socket$inet6(0xa, 0x3, 0xf) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c) fsetxattr$trusted_overlay_redirect(r5, &(0x7f0000000040), &(0x7f0000000180)='./file1/file0\x00', 0xe, 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000300)=ANY=[@ANYBLOB="090000eb0000000000000000e1a5b5b2862fc9a5364131d64df1c069db983434520000078f28e5b47cc861358d8c7f0ac780d5f4f58d7e0014c191eacaa3c647fba8d68967707ad69a2c1aefc72bc5ea26a060390498e80ba951254cd092d555e14595045f6a280a614ddfdb001371f73efa623122066f1c6262902e34138708cca546ec6880", @ANYRES64=r4, @ANYBLOB="018000000000000000", @ANYRES32=r4, @ANYRESDEC]) openat(0xffffffffffffffff, &(0x7f00000001c0)='./file1/file0\x00', 0x80000, 0x4c) write(r3, &(0x7f0000000080)="01", 0x292e9) [ 2453.581272] sg_write: data in/out 120144348/2 bytes for SCSI command 0xed-- guessing data in; [ 2453.581272] program syz-executor.0 not setting count and/or reply_len properly [ 2453.601407] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2453.601407] program syz-executor.1 not setting count and/or reply_len properly 18:23:40 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4020940d, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:23:40 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa30dc38360be40cd1e5", 0x3a) [ 2453.653575] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2453.655252] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:23:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe", 0x32) 18:23:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c548697", 0x28) 18:23:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xf000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:58 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x80086601, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:23:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:23:58 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:23:58 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x3000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:23:58 executing program 7: perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000007ec0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)={0x14, 0x1d, 0x1, 0x0, 0x0, "", [@typed={0x4, 0x0, 0x0, 0x0, @binary}]}, 0x14}], 0x1}, 0x0) ftruncate(0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x72) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0xc) syz_open_procfs(r1, &(0x7f00000001c0)='net/if_inet6\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='timers\x00') clone3(0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f00000014c0), 0x800) getpid() stat(&(0x7f0000000540)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') setresuid(0x0, r2, 0x0) openat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x3, 0x10c) syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file0\x00', 0x6, 0x7, &(0x7f0000000780)=[{&(0x7f0000000300)="6caeebb67d3823c2a648d319874ff15cffdccd0a6ff31e1e8283cb54c945c953b339f50b4dbcdcf963f5219a2a3d986d73fa331257455ee1e0b6be408ca6ee7fdb3e8075808cf0a3cfb1f3a5a95c49b89024b43a3f2166d64757d7fea6a3cd6bd5c9ba9aa64eb0e30c6675ec", 0x6c, 0x8}, {&(0x7f0000000580)="ba8389f2f5a52f4818bb651a7ff13be61a8a24920a9a1816e2ffc62f2aab2d0f9a54c8a2fc35ecf5c356c8db5b63100843260df0c556ed2a8110dc47494db1ba0d7651e7eab2a0a68bac23739796089a6253a27c4d41eb2d8c8b6008ee0ad3f044d0c301b8ffbaeccdafb415185b99acf81c7267f3254dbc955646be8c975c7203817f885c96c83333c6acf1d705f9bfb9ce0dd07ba7e58692bf79d6980668ff2c35e908a7d7e1958b3f97e89705b40eccc18e5bba186851dce71121aebf136efc12e5ea6db125fa536e5c8e702607da2dc6e29740bbe756e6d413b280f59504", 0xe0, 0x4}, {&(0x7f0000000380)="a28b242ea5c644eda3d5f2fc3ea7609039edfcbc1a4259cca1d4da95f94ed7976967bd61261e82eb3a6cd85ae7f2511eb14890ff888fa6da404052c4da8780e7ca609ec768331f550cb25c001e10ac518de0fc33494588fb081bd4e340b613e37569b0b047bb2e49cbfb5009b4f1612ca0c3bc4380792d7d0d6621", 0x7b, 0x5}, {&(0x7f0000000680)="b09467e36bc3265559a4c73d45229bfa694066577d7a1564b4b2b66602f95d486a7e3f78b6725c2b3b6a0ad3998abb46d56d434e0a26d6bc961e3951f4351629bb899606250905425ad91906e6bb8ea735fe1c406e16ae2ff38f317bb7f841c735ca9e752fcf01a350900182527e80897f6216ee42282394d7d774d0f42cff1cf255801e2ee14c825f95a1f6b0cc952ada158ba5a212f812c9111bc12b2be50332c60fcd7b4ed7ef90b68f5c43f83194a456ce9919b6fd91b1373cc8a90f5e3eee7f7e64cd274fc0cd4268a93873", 0xce, 0x6}, {&(0x7f00000004c0)="d4904bd3c2d66667844f3484ca9f1e0e4295af6985c64c1d89d0d8d57babcbcf0f044e8442fe5a20a9455c28d6c271b51397978ab49ce193d13d9694e0bf12117b5e7b1efba1fc293be6f2c2459cca6885be3b71a4770d54", 0x58, 0xfffffffffffffffd}, {&(0x7f0000001540)="7080d37d2355bd73401668694805da57a488295e136b7b3d22c1a28ac478a0da164dd6065c9218c1d2883e5c4b1778d91b0ecba25b8356c9748e980ef35735d1a1d38323d8ec984a85b24736703a1be801e2f2a1a8521bb67bbfbe96c8ed86872d0e816b673d78d84558d4c2c2ac905ab1deb9a124cb33297c08cd145374cfe1e94bead47b2340823e4b9ff133c7f5a1f3e4c3734977f7affff63251a1ff74f9d24dc1a01daa6025dbffb1a262aec4e6fca98248126a36f7a1714cf09f0cf9ebb0166f4463d39ee487f08e39fc9a2eb6097bdca96c354f78d1f2d55bb066684bf553e95c653b1cc85d31dc5efc13df671d2dba7c3d0b4d4eb71ce3260b8a24c570a0931fb25b8bf1c9962a1e6b6df6d6f46cd0dc3214b6e91403d2abe9c13258640aaabaa58d26d6d4f07137f1a8e364006ca67acd9ad83b5dccf27fc3a294f3ee7fc37d59c2854f26bcf9164e6b0da82ecc0eed2dac852306cc87b57abf4442bebd7911dafa4750cda57b482cce13908c70685b856e233467ed8ed3de021ba708e1d249d2a0832c6b443d97b3c9a39fe38d9c7ad6fd76bf03c8cb020721091ec587bc9ae71a6c24af1ce888d2bf2d564554ad5741145a2dba05d9c72e0751d6de0f729364d39562dca4a412006d8747c39fa726d3bf1696161b94e40895b4e5b49a2d14e534df5ed70fe155da15348f9bb6212cc40f739055d1eec4def46bb3f769017c53a472d29eeba0adc62a99675b1f0a18e6fe7814c1a26ba6ca373c05db43f013da8c34602f712ca96e5b7745effb955e568621f7146b8551f703b95fc27b8aa11ccac313224f8e371c8d0b1ab22af167f56616b2c994e0aadfdb957e2901493142ea20c6396e36cfba5416e8cae81c8c7c56376a116f303fc1cda829dd6277c5ed9e30f6bca54ad9ea57dc36b5d3832dcc286af7bb045331eee99b457266b075666e47fb714afe3b3c230a0a01b82864ed03d0e8e36db2b07659465b64c7c01495baeca0868fc79b74bf6202b598b0975f97fd126ba9b9f887d04e7193ad74224a144254e2b60cc7abfe37a7c9770e768cdde4df540a6182544f0e06dd5d573ed725354e8f06745072a3da685c7ab213e78a9b1444eadb40b9bf154a7ecb636deb84e2ff044fdb6740f9ed4580b8ec5c492905065204ccdd0fd6a76d99d957fb9a724f7e29f0c98165d66bd78c7df8c8ad6a197a2f05759ac240537bbb4549a3c38057e049f4b34c18d5b189eafade7b46f9d434c90c1a2091edac7af375a2c21aa32c0c5a83a621e7a431a99584dd445fc5da8dc3af240d7c7f4acbb57851dcf0527891b3b41ba19cfc91c9118154de21ec914ec7f80078fa8065c9c87ac9035f35539d8d5eb5df7f89e9d3cccd234583b8ee538e1462a69e8f666be387e18238e3c46957a9416cc12b6f32ff2f284b20c0d4451caeb814e9b51dfc2f8512f690f90193fc3d92334282a5545a8bb498523253f05468cea258c37ab977cf0e16e77cec78b8e8fcdbad4106d8e925f2372d021bf81a9934e4fdf4dea1e0aeccd1912988dc16335aa7f244664223ba061c0a0e02a45018b4a876d18963418df94b6d203cb766d0b33bc55ca8ae9ac55d2fa23c951882b49a7d8354db8dcddb0eb8087b5903a5f6b6887b08329c7689d4f8483b9b4077e0d59e25a004f4252026fa0f23d9fcdd52e7409a8799fcf5a7e0464206054225945ffa7c327abbcb5bb397c841b2cbbcfec8bacd116930b1e5064659979f650cbd9d77ac28b3c736439210e3b3afaaf9d8ed4cfd7ac51c3f67b5aeaba2da7f6eaada2f555c70e298b0a48eb968bc45901be9f537f4c01eb458ea00f960e1e400afee098c89de0a1c1b9f49523fd2d97f1c044262bbc6305127676eaee58e582171e184abfcb39a865e483d4b6f57fdae2760e0e3349ca719ee2458ae7508dde777b5aff7014a449f7bf9dd41405c91abc469274c5039e6ddf3a1e0d5083480a241106dfadba62779fe3249b3843b9a685e1cdb76719a5c45b93857e10d81ab0872d3c55f2376cc75ce846e6b98bac53141623b74907890711de9d464289e090253eca981ee0254413f4aa3c799e64e36d9e077d02ebb64b5a9d7fa909d767cd8d71e5aa7798b5ca553a720e986a3fae9b3df851cddd1494b1488f2d6be4172591de66acb48467b949043a50123338e34894c772ce7268264ed8ec57b4bb6843e9094e4769dbd88987d5b49354dfe6f43b68e6d93755caad73f602302419261ede1c2a2d1c926aab833aa9f51724fe60163dda2af1b2eb2c9aea969fd20b474ab673b4a950031cc2c2ce5b451b008041a79aaf8319d56a5cf54134b0f9430b1fa7a67c1eac60ab1b6ec0a885dc280ec699f1dbeaf01b3904d6b35604cce7d56339d421ad054127a0a118bc98169e997df621ac60ac6659a867cea8f7c6e3d0adde5e9d80cfef3b91e6a6856f4a0e004dab68fb2052a9c9c1a9f6eece05db26903d15664cbabbc8940c461df75eaa01c728e609a63da1602e67a4cf05c84c71bdabe51042620d2f669720e9715b0ba1ec4405e81f164443b2275d786ac076559229384c9a9a6a2f2dd178456072e177382074a61f5dfcd6f6e9fc3b5e0d5b20a2de12d3b95463c93ed695044d6b1eb8b39db2dc01d96e565126de255422cf2bd90dc9333ff1ffdc7626d3d63d1ba65448f955c733e561ee524172cde15339509b4088337810fa773c06f9e668ae26dafcdfebcca7cb1f65bd81d5ab86eec1aa25e4a23c9ba629b3aee95a881cfa3cc2c7d947d264f6dfc2c692e6a3a3e8946d00e951111c7540b051580592ccfd900e9cf460c352946e4d1adbf4b3d5e28218346eb238a8dab51169a4ce922711bf71bc720adcdd566080142781c43edf696a98f4654bfbdd9a78cd06ae9b8881649f85c3cfac6959eb04313534672c0b4b9bd71b1eae06ff4b9867a6d199f2093569c32030b54f8650b589bb51115f47eabef4aa162f2db813c73c315c0ad3c84d09cbe0c664918679088a7755c2702172445a92045f90863127af65513e47976ba2646dd53bf1a25a162b4f133b8af873fa4d4247ad210fcdeb7638061622c13a2d8c0437516adddb97eb22192a0a71d435b9090a18d93a35cae8f83bdac2bbdd21c053cedd2e4e91565e898ffa6a183177894b9de1326803929584ee3bcea478e614ab98d43af1efadb5928cb69c0ff8afa633608f7fc33f79abdb848a9ffdf158a2263a9d28b413b9e82d0ac35f1ef722ab80a3a7e22e8e01213cd419dadd68e750caa0c5e8623732e08bbf96526c52026de461506c48858cfae7ca93b13a1b994740063f00a0b91d326e95af9fcd2fc596d8967d700b4ee4b1cfd9587ff959b1e7eaa3cc6cdf18322ee0f051c31039fab5b10118c6aeb5dfafbb50d72d7bd35e88607a1365e4d9f34efcedbc0ebdecfddbacba6fd65bc177f7a38483be7c6fac1ac1f8570b2de6b4d5726364138df1ecfbaee7e0b5dea71a7e80365695293a97d36be50bf2478096e1c71d900d81d7a62f8986fecf2e2b078d225fbd06107c8a70ef12c1d6945665d40852df9ef7f514269cef10e525691bb4af78f564b2eae58f91f0185a9f28fd0b81870b7951a8273d5462d6435277b2a342b517cd8be1cf0bf35308aeb1e144a417d078026f4a79d0b1dbcd4b3922888ae61e7c93f27aeef6dea7b3e4da95a068ef9b908633424ff7f978af09c5b222c200f0ccc15f4eec47a1b573c3d08b531c33840827d963e2b64d26af9a0757d548dd7c88e327bfbfbe855d7a62b1a2e714d4128cd26917ba79a71e8102a17d41aa2096dfc53417b02e0c61f9f627115b3358b4e3cb992b645630e1260f1ee522e6217d472c6087bdddc21389772ed73181c442a688076d9529d7bb8592336f2ffc4305552769244c1404c5889129344646906deaa57a0ac9dcb88c43c1948fcc9dea1e7590d92581185dfe49fec0cd544dcdd9837738f893fe89aad942806a11e5476c49c74673688afc219114d4a8c63c233d2f300f037b0a99e49560a25486d99253af2c8b555f25698616bf3ad6d82b179cba7c8ca22112675e27872454417bed7a3b9e779bf4763286a1631d8faa4fccd44febb871fa6ceb59979251e1ac8fe05d5ee590b0c4ad57130f11d14a3860f873def5353a1d942fd5b9b2f84e9dceef67c3b6edf25efa8fd61f21cbcebfa04fc026acf509be88c489d205351bc31b1ca134ed155b034f09fd5e0527511403e6834057565b3d6eeedaea282d0e76ece29b60225b65f605a3fb216a6c26ae2cda0f041314670ff8ce74abd462913be9db141c671526258bc51f8761b859554f014e31f382b61120004eb42895db3bd474246eaca1c0cc0fe395ad10c3175be8f2d769dbaefca2f211eae0bf4fdc35f89bd0333fac89846a2d5bbb29c718388f2c61e297119f8bfc048a7b4c18469b87941cf16d677221b3127fa8b6b0116fc302f8e38d36aed958d908c9f3ead022fcf4e491dbdd878dedcff3f849839685c460686fce201a817689146e483459c51e8f6507c1602430fc4be3ca9448a8a78d6a8fee07093dfa58633eefd4e3ee80b0a10c8185ebd141504e385da280982806af24d90e40f8015075a997555d0ca9e1706f6678071619b2bc594d9bdb04235aff6f7dd94a05ef9d14250dd2e7bdd0deb3b9c4483ac4850c5ac86ac2f5bdd484aecedfb582798c567cfb2ea656db3f86bc486a928b3083e33389b5e30fc76d00272aac761a46faa3bb6927d07ff3139efe57fed2ffeb00a7c79a8c09f39622c6567685bd3a76564ce6612d5fb993a612ad9202bbcca2b7e9ea5e794c096c94695127843a560b70bb6debc22920d1f6a73f5cb029f0af39d57a6a2daeaca10c562a141490ef589217c25564aaae0a7018180f84eb238f4ffb0c9fc3992f0c74ecbb39e194738146a84a636aeee88a149507961e65a30da42cef14a20d649e3e4d84f0f849f7e63e3ca9d5caaf943d2818540e0a69cf05a5586384cb689f856d92555f54aba224aa3998760c45ea78d312b2c3266bdba9006f733346d991975e109eea66b941e95d59862ccd9feeb8d8e135d3abf50095c88653caf046076aef2609fc9fc0fdb8af72ce1db1d2e186b44f9b974d07dc104c9e9eecc394072e1ffdadf27b1339ffd3df1c637eeeab2f800dda72ed9ae36ff22b5c7dc2d5a90ed2a760ef958571ddc2c828ae770f174541088dcfd435fb220b54410afc85407cbaf97ea9285f2693a14bc06b196d7ad29998266d43c12a63b2bf737d8f2bb2d6999c8a0aa6a68aaf7b447577dbebefba841909bc97491695445927e32a1af0485d278deb1355147c567d35b9088cdd878b232226ccc5d175c40e20922f5e4619f18880c3dc2a84508c2e7cc1ccffb264a3ed076d20c4dfe320f61d530a54ee81f63d92a0da3f99c5f173ae63183ac812580f2d2060529a93499b81e3df5e3806cf78060ee1eced01e63e3feb104d42a15c5f857074a6d7177b5bcc1bb98ce714d1b3bf0970971dbbbd60b3acbfab41d7fcd3b7624aa5d7bf0c3ea77736649c8fa43eccba2860046fb66f167b2419b0e8859eefcb8210c605c10641de8176d6744578233a35ee7ce5c5c6cd68eb7c88541ba9516d7c284a273b68d64c750d03ad98f01ebc2a8e3780a0a910a0dd38bf58e9472e8cc66349428965a2feb3e5587413e5408df6fd448740a244ea1c5aecf6ff9c744e1513f44e41d0e75357a52dd9ddb54746b7bc2e639d8653854ccd58b632199815aeffb9c45b88ce406aec0c37515f16f8f19456168b6b698841f2ef03170", 0x1000, 0xfffffffffffffffd}, {&(0x7f0000000400), 0x0, 0x401}], 0x8802, &(0x7f0000000840)={[{@data_writeback}, {@errors_remount}, {@grpjquota_path={'grpjquota', 0x3d, './file0'}}], [{@seclabel}]}) 18:23:58 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2471.716575] sg_write: data in/out 120144348/2 bytes for SCSI command 0xed-- guessing data in; [ 2471.716575] program syz-executor.0 not setting count and/or reply_len properly [ 2471.718733] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2471.718733] program syz-executor.1 not setting count and/or reply_len properly [ 2471.723862] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:23:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:23:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c548697", 0x28) 18:23:58 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, 0x0, 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:23:58 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x4000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2471.824122] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:23:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe", 0x32) [ 2471.854795] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2471.854795] program syz-executor.1 not setting count and/or reply_len properly [ 2471.909588] sg_write: data in/out 120144348/2 bytes for SCSI command 0xed-- guessing data in; [ 2471.909588] program syz-executor.0 not setting count and/or reply_len properly 18:24:19 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x5000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:19 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000004c00)={0xc0002100, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000100)={0x0, 0x1f, 0x3000, 0x1}) r1 = gettid() setpriority(0x1, r1, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x2, 0x3, 0x20, 0x2, 0x0, 0x7, 0x808, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, @perf_config_ext={0x6b, 0x6}, 0x4, 0x6, 0x26, 0x0, 0x7, 0x4, 0xffff, 0x0, 0x0, 0x0, 0x8}, r1, 0x4, r0, 0x2) 18:24:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c548697", 0x28) 18:24:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x10000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf211", 0x35) 18:24:19 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x80087601, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:24:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:24:19 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, 0x0, 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2492.707789] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2492.707789] program syz-executor.1 not setting count and/or reply_len properly [ 2492.742446] sg_write: data in/out 120144348/5 bytes for SCSI command 0xed-- guessing data in; [ 2492.742446] program syz-executor.0 not setting count and/or reply_len properly 18:24:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) 18:24:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) [ 2492.792728] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2492.796320] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:24:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:24:19 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, 0x0, 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2492.881198] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2492.881198] program syz-executor.0 not setting count and/or reply_len properly 18:24:19 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x6000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x3c0b0000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:19 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x801c581f, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2492.971122] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2492.971122] program syz-executor.1 not setting count and/or reply_len properly 18:24:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c548697", 0x28) 18:24:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:24:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) (fail_nth: 1) [ 2493.130426] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2493.165622] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2493.165622] program syz-executor.0 not setting count and/or reply_len properly [ 2493.191759] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:24:19 executing program 7: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, 0x0, 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:24:19 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2493.245933] FAULT_INJECTION: forcing a failure. [ 2493.245933] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2493.247639] CPU: 1 PID: 11334 Comm: syz-executor.1 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2493.248661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2493.249666] Call Trace: [ 2493.250006] [ 2493.250310] dump_stack_lvl+0x8f/0xb7 [ 2493.250835] should_fail_ex.cold+0x5/0xa [ 2493.251386] _copy_from_user+0x2e/0x180 [ 2493.251922] sg_write.part.0+0x1c9/0xa90 [ 2493.252478] ? perf_trace_lock_acquire+0xfd/0x530 [ 2493.253126] ? __pfx_sg_write.part.0+0x10/0x10 [ 2493.253736] ? __lock_acquire+0xbad/0x5e70 [ 2493.254321] ? lock_is_held_type+0xdb/0x130 [ 2493.254903] ? inode_security+0x105/0x140 [ 2493.255493] ? avc_policy_seqno+0xd/0x70 [ 2493.256033] ? selinux_file_permission+0x3a/0x510 [ 2493.256682] sg_write+0x88/0xe0 [ 2493.257158] vfs_write+0x2cf/0xd90 [ 2493.257652] ? __pfx_sg_write+0x10/0x10 [ 2493.258196] ? __pfx_vfs_write+0x10/0x10 [ 2493.258755] ? __fget_files+0x270/0x450 [ 2493.259301] ? __fget_light+0xe5/0x280 [ 2493.259831] ksys_write+0x12b/0x260 [ 2493.260335] ? __pfx_ksys_write+0x10/0x10 [ 2493.260890] ? syscall_enter_from_user_mode+0x21/0x50 [ 2493.261564] ? syscall_enter_from_user_mode+0x21/0x50 [ 2493.262255] do_syscall_64+0x3f/0x90 [ 2493.262771] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2493.263478] RIP: 0033:0x7f02abfd5b19 [ 2493.263967] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2493.266183] RSP: 002b:00007f02a954b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2493.267113] RAX: ffffffffffffffda RBX: 00007f02ac0e8f60 RCX: 00007f02abfd5b19 [ 2493.268025] RDX: 0000000000000034 RSI: 00000000200000c0 RDI: 0000000000000003 [ 2493.268903] RBP: 00007f02a954b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2493.269794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2493.270688] R13: 00007ffe07a33c3f R14: 00007f02a954b300 R15: 0000000000022000 [ 2493.271618] 18:24:20 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) [ 2493.418777] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2493.418777] program syz-executor.0 not setting count and/or reply_len properly 18:24:37 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:24:37 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) (fail_nth: 2) 18:24:37 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c548697", 0x28) 18:24:37 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0xc0045878, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:24:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc00e0000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:37 executing program 7: lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.posix_acl_default\x00', &(0x7f0000000180)='\x02', 0x1, 0x0) r0 = epoll_create(0xdba) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0xaad6}}, './file0\x00'}) 18:24:37 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:24:37 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x7000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2510.948948] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2510.948948] program syz-executor.0 not setting count and/or reply_len properly [ 2510.951948] FAULT_INJECTION: forcing a failure. [ 2510.951948] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2510.952759] CPU: 0 PID: 11346 Comm: syz-executor.1 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2510.953309] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2510.953862] Call Trace: [ 2510.954048] [ 2510.954206] dump_stack_lvl+0x8f/0xb7 [ 2510.954487] should_fail_ex.cold+0x5/0xa [ 2510.954790] _copy_from_user+0x2e/0x180 [ 2510.955088] sg_write.part.0+0x5f1/0xa90 [ 2510.955386] ? __pfx_sg_write.part.0+0x10/0x10 [ 2510.955720] ? __lock_acquire+0xbad/0x5e70 [ 2510.956036] ? lock_is_held_type+0xdb/0x130 [ 2510.956355] ? inode_security+0x105/0x140 [ 2510.956658] ? avc_policy_seqno+0xd/0x70 [ 2510.956943] ? selinux_file_permission+0x3a/0x510 [ 2510.957293] sg_write+0x88/0xe0 [ 2510.957540] vfs_write+0x2cf/0xd90 [ 2510.957799] ? __pfx_sg_write+0x10/0x10 [ 2510.958096] ? __pfx_vfs_write+0x10/0x10 [ 2510.958395] ? __fget_files+0x270/0x450 [ 2510.958687] ? __fget_light+0xe5/0x280 [ 2510.958969] ksys_write+0x12b/0x260 [ 2510.959240] ? __pfx_ksys_write+0x10/0x10 [ 2510.959535] ? syscall_enter_from_user_mode+0x21/0x50 [ 2510.959918] ? syscall_enter_from_user_mode+0x21/0x50 [ 2510.960286] do_syscall_64+0x3f/0x90 [ 2510.960560] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2510.960927] RIP: 0033:0x7f02abfd5b19 [ 2510.961194] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2510.962380] RSP: 002b:00007f02a954b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2510.962892] RAX: ffffffffffffffda RBX: 00007f02ac0e8f60 RCX: 00007f02abfd5b19 [ 2510.963374] RDX: 0000000000000034 RSI: 00000000200000c0 RDI: 0000000000000003 [ 2510.963859] RBP: 00007f02a954b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2510.964348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2510.964832] R13: 00007ffe07a33c3f R14: 00007f02a954b300 R15: 0000000000022000 [ 2510.965333] 18:24:37 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:24:37 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) (fail_nth: 3) [ 2511.037758] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2511.037758] program syz-executor.0 not setting count and/or reply_len properly 18:24:37 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) [ 2511.069882] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2511.072142] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:24:37 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2511.092637] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2511.092637] program syz-executor.1 not setting count and/or reply_len properly [ 2511.098303] FAULT_INJECTION: forcing a failure. [ 2511.098303] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2511.099109] CPU: 0 PID: 11366 Comm: syz-executor.1 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2511.099685] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2511.100236] Call Trace: [ 2511.100422] [ 2511.100588] dump_stack_lvl+0x8f/0xb7 [ 2511.100875] should_fail_ex.cold+0x5/0xa [ 2511.101171] _copy_to_user+0x2e/0x150 [ 2511.101443] simple_read_from_buffer+0xd0/0x170 [ 2511.101796] proc_fail_nth_read+0x19c/0x230 [ 2511.102104] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2511.102450] ? security_file_permission+0xb5/0xe0 [ 2511.102797] vfs_read+0x257/0x940 [ 2511.103057] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2511.103398] ? __pfx_vfs_read+0x10/0x10 [ 2511.103702] ? __fget_files+0x270/0x450 [ 2511.104001] ksys_read+0x12b/0x260 [ 2511.104263] ? __pfx_ksys_read+0x10/0x10 [ 2511.104565] ? syscall_enter_from_user_mode+0x21/0x50 [ 2511.104927] ? syscall_enter_from_user_mode+0x21/0x50 [ 2511.105302] do_syscall_64+0x3f/0x90 [ 2511.105583] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2511.105953] RIP: 0033:0x7f02abf8869c [ 2511.106214] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2511.107431] RSP: 002b:00007f02a954b170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2511.107960] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f02abf8869c [ 2511.108441] RDX: 000000000000000f RSI: 00007f02a954b1e0 RDI: 0000000000000004 [ 2511.108962] RBP: 00007f02a954b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2511.109474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2511.109980] R13: 00007ffe07a33c3f R14: 00007f02a954b300 R15: 0000000000022000 [ 2511.110506] 18:24:37 executing program 7: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000003c0), 0x40041) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000380), 0x8}, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x42002, 0x0, 0x80000000, 0x0, 0x0, 0x10001, 0x400, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$inet6(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000480), &(0x7f0000000280)=0x4) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmsg$NFT_MSG_GETGEN(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000500)={0x14, 0x10, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x6}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4020806) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) connect$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xdafc}, 0x1c) fchdir(r2) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f0000000100)={'hsr0\x00'}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @remote}, 0x10) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000540)={0x0, 0x2, 0x0, 'queue1\x00', 0x48}) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000240)) write$sndseq(r0, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw8={"6a4110372e4321349a15abcc"}}], 0x1c) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000400)={'veth1_virt_wifi\x00', {0x2, 0x0, @multicast1}}) 18:24:37 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c548697", 0x28) [ 2511.137553] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2511.137553] program syz-executor.0 not setting count and/or reply_len properly 18:24:52 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x8000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9c", 0x33) 18:24:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d", 0x2d) 18:24:52 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0xc0045878, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:24:52 executing program 7: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000003c0), 0x40041) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000380), 0x8}, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x42002, 0x0, 0x80000000, 0x0, 0x0, 0x10001, 0x400, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$inet6(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000480), &(0x7f0000000280)=0x4) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmsg$NFT_MSG_GETGEN(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000500)={0x14, 0x10, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x6}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4020806) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) connect$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xdafc}, 0x1c) fchdir(r2) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f0000000100)={'hsr0\x00'}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @remote}, 0x10) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000540)={0x0, 0x2, 0x0, 'queue1\x00', 0x48}) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000240)) write$sndseq(r0, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw8={"6a4110372e4321349a15abcc"}}], 0x1c) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000400)={'veth1_virt_wifi\x00', {0x2, 0x0, @multicast1}}) 18:24:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:24:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xffffff7f, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:52 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2526.226183] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2526.226183] program syz-executor.1 not setting count and/or reply_len properly [ 2526.236874] sg_write: data in/out 120144348/3 bytes for SCSI command 0xed-- guessing data in; [ 2526.236874] program syz-executor.0 not setting count and/or reply_len properly [ 2526.279337] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:24:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="0a0008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2526.297411] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:24:53 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:24:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d", 0x2d) 18:24:53 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x9000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x2}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:24:53 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0xc0189436, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2526.468247] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2526.468247] program syz-executor.1 not setting count and/or reply_len properly 18:24:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) (fail_nth: 1) 18:24:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d", 0x2d) [ 2526.580931] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2526.610443] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2526.640214] FAULT_INJECTION: forcing a failure. [ 2526.640214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2526.642246] CPU: 1 PID: 11418 Comm: syz-executor.0 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2526.643365] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2526.644423] Call Trace: [ 2526.644773] [ 2526.645080] dump_stack_lvl+0x8f/0xb7 [ 2526.645646] should_fail_ex.cold+0x5/0xa [ 2526.646254] _copy_from_user+0x2e/0x180 [ 2526.646800] sg_write.part.0+0x1c9/0xa90 [ 2526.647347] ? perf_trace_lock_acquire+0xfd/0x530 [ 2526.647989] ? __pfx_sg_write.part.0+0x10/0x10 [ 2526.648612] ? __lock_acquire+0xbad/0x5e70 [ 2526.649193] ? lock_is_held_type+0xdb/0x130 [ 2526.649785] ? inode_security+0x105/0x140 [ 2526.650347] ? avc_policy_seqno+0xd/0x70 [ 2526.650889] ? selinux_file_permission+0x3a/0x510 [ 2526.651532] sg_write+0x88/0xe0 [ 2526.652001] vfs_write+0x2cf/0xd90 [ 2526.652498] ? __pfx_sg_write+0x10/0x10 [ 2526.653045] ? __pfx_vfs_write+0x10/0x10 [ 2526.653610] ? __fget_files+0x270/0x450 [ 2526.654165] ? __fget_light+0xe5/0x280 [ 2526.654691] ksys_write+0x12b/0x260 [ 2526.655207] ? __pfx_ksys_write+0x10/0x10 [ 2526.655783] ? syscall_enter_from_user_mode+0x21/0x50 [ 2526.656491] ? syscall_enter_from_user_mode+0x21/0x50 [ 2526.657202] do_syscall_64+0x3f/0x90 [ 2526.657716] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2526.658403] RIP: 0033:0x7f008f6cbb19 [ 2526.658870] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2526.661071] RSP: 002b:00007f008cc41188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2526.662005] RAX: ffffffffffffffda RBX: 00007f008f7def60 RCX: 00007f008f6cbb19 [ 2526.662905] RDX: 0000000000000034 RSI: 00000000200000c0 RDI: 0000000000000003 [ 2526.663794] RBP: 00007f008cc411d0 R08: 0000000000000000 R09: 0000000000000000 [ 2526.664693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2526.665573] R13: 00007ffdfe12e19f R14: 00007f008cc41300 R15: 0000000000022000 [ 2526.666501] 18:25:09 executing program 7: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000003c0), 0x40041) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000380), 0x8}, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x42002, 0x0, 0x80000000, 0x0, 0x0, 0x10001, 0x400, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$inet6(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000480), &(0x7f0000000280)=0x4) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmsg$NFT_MSG_GETGEN(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000500)={0x14, 0x10, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x6}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4020806) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) connect$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xdafc}, 0x1c) fchdir(r2) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f0000000100)={'hsr0\x00'}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @remote}, 0x10) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000540)={0x0, 0x2, 0x0, 'queue1\x00', 0x48}) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000240)) write$sndseq(r0, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw8={"6a4110372e4321349a15abcc"}}], 0x1c) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000400)={'veth1_virt_wifi\x00', {0x2, 0x0, @multicast1}}) 18:25:09 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:25:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) (fail_nth: 2) 18:25:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320208000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:09 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xa000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:09 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0xc020660b, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:25:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x3}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd", 0x2f) [ 2542.409793] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2542.409793] program syz-executor.1 not setting count and/or reply_len properly [ 2542.411342] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2542.432760] FAULT_INJECTION: forcing a failure. [ 2542.432760] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2542.434288] CPU: 0 PID: 11441 Comm: syz-executor.0 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2542.435312] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2542.436353] Call Trace: [ 2542.436688] [ 2542.437003] dump_stack_lvl+0x8f/0xb7 [ 2542.437540] should_fail_ex.cold+0x5/0xa [ 2542.438112] _copy_from_user+0x2e/0x180 [ 2542.438665] sg_write.part.0+0x5f1/0xa90 [ 2542.439234] ? __pfx_sg_write.part.0+0x10/0x10 [ 2542.439879] ? __lock_acquire+0xbad/0x5e70 [ 2542.440496] ? lock_is_held_type+0xdb/0x130 [ 2542.441107] ? inode_security+0x105/0x140 [ 2542.441664] ? avc_policy_seqno+0xd/0x70 [ 2542.442212] ? selinux_file_permission+0x3a/0x510 [ 2542.442864] sg_write+0x88/0xe0 [ 2542.443326] vfs_write+0x2cf/0xd90 [ 2542.443834] ? __pfx_sg_write+0x10/0x10 [ 2542.444399] ? __pfx_vfs_write+0x10/0x10 [ 2542.444970] ? __fget_files+0x270/0x450 [ 2542.445526] ? __fget_light+0xe5/0x280 [ 2542.446060] ksys_write+0x12b/0x260 [ 2542.446560] ? __pfx_ksys_write+0x10/0x10 [ 2542.447126] ? syscall_enter_from_user_mode+0x21/0x50 [ 2542.447817] ? syscall_enter_from_user_mode+0x21/0x50 [ 2542.448513] do_syscall_64+0x3f/0x90 [ 2542.449032] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2542.449716] RIP: 0033:0x7f008f6cbb19 [ 2542.450202] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2542.452509] RSP: 002b:00007f008cc41188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2542.453471] RAX: ffffffffffffffda RBX: 00007f008f7def60 RCX: 00007f008f6cbb19 [ 2542.454373] RDX: 0000000000000034 RSI: 00000000200000c0 RDI: 0000000000000003 [ 2542.455279] RBP: 00007f008cc411d0 R08: 0000000000000000 R09: 0000000000000000 [ 2542.456184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2542.457091] R13: 00007ffdfe12e19f R14: 00007f008cc41300 R15: 0000000000022000 [ 2542.458036] [ 2542.472328] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:25:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd", 0x2f) 18:25:09 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="0002"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:25:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320308000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x4}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:09 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x4000)=nil, 0x4000, &(0x7f0000000340)=""/147) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="0180000008000000000f0000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:25:09 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xb000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:09 executing program 7: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000003c0), 0x40041) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000380), 0x8}, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x200, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x42002, 0x0, 0x80000000, 0x0, 0x0, 0x10001, 0x400, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$inet6(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000480), &(0x7f0000000280)=0x4) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendmsg$NFT_MSG_GETGEN(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000500)={0x14, 0x10, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x6}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4020806) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x30c) connect$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xdafc}, 0x1c) fchdir(r2) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f0000000100)={'hsr0\x00'}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @remote}, 0x10) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000540)={0x0, 0x2, 0x0, 'queue1\x00', 0x48}) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000240)) write$sndseq(r0, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw8={"6a4110372e4321349a15abcc"}}], 0x1c) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000400)={'veth1_virt_wifi\x00', {0x2, 0x0, @multicast1}}) 18:25:09 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) (fail_nth: 3) [ 2542.665607] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2542.665607] program syz-executor.1 not setting count and/or reply_len properly [ 2542.701752] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:25:09 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd", 0x2f) 18:25:09 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320408000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2542.787509] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2542.787509] program syz-executor.0 not setting count and/or reply_len properly [ 2542.790190] FAULT_INJECTION: forcing a failure. [ 2542.790190] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2542.791802] CPU: 1 PID: 11462 Comm: syz-executor.0 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2542.792831] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2542.793582] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2542.793817] Call Trace: [ 2542.795213] [ 2542.795516] dump_stack_lvl+0x8f/0xb7 [ 2542.796033] should_fail_ex.cold+0x5/0xa [ 2542.796600] _copy_to_user+0x2e/0x150 [ 2542.797118] simple_read_from_buffer+0xd0/0x170 [ 2542.797749] proc_fail_nth_read+0x19c/0x230 [ 2542.798342] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2542.798980] ? security_file_permission+0xb5/0xe0 [ 2542.799628] vfs_read+0x257/0x940 [ 2542.800130] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2542.800763] ? __pfx_vfs_read+0x10/0x10 [ 2542.801335] ? __fget_files+0x270/0x450 [ 2542.801901] ksys_read+0x12b/0x260 [ 2542.802404] ? __pfx_ksys_read+0x10/0x10 [ 2542.802964] ? syscall_enter_from_user_mode+0x21/0x50 [ 2542.803659] ? syscall_enter_from_user_mode+0x21/0x50 [ 2542.804373] do_syscall_64+0x3f/0x90 [ 2542.804890] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2542.805580] RIP: 0033:0x7f008f67e69c [ 2542.806065] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2542.808316] RSP: 002b:00007f008cc41170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2542.809280] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007f008f67e69c [ 2542.810191] RDX: 000000000000000f RSI: 00007f008cc411e0 RDI: 0000000000000004 [ 2542.811107] RBP: 00007f008cc411d0 R08: 0000000000000000 R09: 0000000000000000 [ 2542.812037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2542.812981] R13: 00007ffdfe12e19f R14: 00007f008cc41300 R15: 0000000000022000 [ 2542.813920] [ 2542.908816] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2542.908816] program syz-executor.1 not setting count and/or reply_len properly 18:25:26 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="0002"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:25:26 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:26 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320408000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:26 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000340)=ANY=[@ANYBLOB="018000000000000008440000fd41a5efbedcdd24975bcb0977c3c75c2c3882825e2aa62ca8821c7479b04877afda61a3099439ca038214e6241a9d32352774c408c4600e47d33d4f78a6f772693d3818ca815d5d8ffade6ca7d1faf69c3406b621be4eeb5bf4d8d9d2", @ANYRES32=r2, @ANYBLOB="00000000000000002e2f66696c65300023e23cffed40c1cf2bb3343cecae65d2b4ddf89f8b604f18f47f90ef9d0b21e5616ad38f7e0ab3883cffa3c7b3f0ea7eb07d80bad06f40dba60043dfd3307e969d07d46565d6f07c50c17974e74c4890db2cda9b649be5f53b1844de1058"]) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:25:26 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:26 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9e", 0x30) 18:25:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320508000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x5}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2559.325263] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2559.325263] program syz-executor.0 not setting count and/or reply_len properly [ 2559.330937] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:25:26 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="0a0008000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2559.398440] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2559.398440] program syz-executor.0 not setting count and/or reply_len properly [ 2559.401964] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2559.401964] program syz-executor.1 not setting count and/or reply_len properly [ 2559.463946] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:25:48 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000340)=ANY=[@ANYBLOB="018000fa000000001800000082d1e7ce3e5745941551d447a2cc44f470d6bf7af7dc57c93cdb4031b570ea0a2276e22e04a0f2904c15dc7becd2ebbb07c92a9762fa8ea3ad16ff66135e4d6153a97d2bbd1cf6ff6ad1a86a3db93963eb33cefca6e9f3e51dab8836070810a776fd9eaa18b2955f2c966d5112d625", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:25:48 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x6}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:48 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xd000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:48 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9e", 0x30) 18:25:48 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="0002"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:25:48 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320208000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:48 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9e", 0x30) 18:25:48 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320608000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2582.047945] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2582.047945] program syz-executor.0 not setting count and/or reply_len properly [ 2582.055339] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2582.055339] program syz-executor.1 not setting count and/or reply_len properly [ 2582.060290] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:25:48 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320708000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:48 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:25:48 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9e", 0x30) 18:25:48 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9e", 0x30) [ 2582.106375] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:25:48 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x7}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:48 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320308000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2582.179721] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2582.179721] program syz-executor.0 not setting count and/or reply_len properly [ 2582.183665] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2582.183665] program syz-executor.1 not setting count and/or reply_len properly 18:25:48 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xe000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:25:48 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9e", 0x30) [ 2582.232220] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2582.383943] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:25:49 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1ff, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:25:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320408000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) (fail_nth: 1) 18:25:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320a08000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:25:49 executing program 7: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0007}]}) r0 = shmget$private(0x0, 0x9000, 0x8, &(0x7f0000ff4000/0x9000)=nil) shmctl$IPC_RMID(r0, 0x0) shmat(r0, &(0x7f0000ffc000/0x2000)=nil, 0x1800) 18:25:49 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:25:49 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x8}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2582.417212] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2582.417212] program syz-executor.0 not setting count and/or reply_len properly [ 2582.421441] FAULT_INJECTION: forcing a failure. [ 2582.421441] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2582.422218] CPU: 1 PID: 11551 Comm: syz-executor.5 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2582.422798] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2582.423305] Call Trace: [ 2582.423478] [ 2582.423630] dump_stack_lvl+0x8f/0xb7 [ 2582.423898] should_fail_ex.cold+0x5/0xa [ 2582.424170] _copy_from_user+0x2e/0x180 [ 2582.424430] sg_write.part.0+0x1c9/0xa90 [ 2582.424718] ? perf_trace_lock_acquire+0xfd/0x530 [ 2582.425058] ? __pfx_sg_write.part.0+0x10/0x10 [ 2582.425390] ? __lock_acquire+0xbad/0x5e70 [ 2582.425707] ? lock_is_held_type+0xdb/0x130 [ 2582.426024] ? inode_security+0x105/0x140 [ 2582.426327] ? avc_policy_seqno+0xd/0x70 [ 2582.426619] ? selinux_file_permission+0x3a/0x510 [ 2582.426963] sg_write+0x88/0xe0 [ 2582.427214] vfs_write+0x2cf/0xd90 [ 2582.427477] ? __pfx_sg_write+0x10/0x10 [ 2582.427765] ? __pfx_vfs_write+0x10/0x10 [ 2582.428059] ? __fget_files+0x270/0x450 [ 2582.428358] ? __fget_light+0xe5/0x280 [ 2582.428656] ksys_write+0x12b/0x260 [ 2582.428933] ? __pfx_ksys_write+0x10/0x10 [ 2582.429229] ? syscall_enter_from_user_mode+0x21/0x50 [ 2582.429599] ? syscall_enter_from_user_mode+0x21/0x50 [ 2582.429959] do_syscall_64+0x3f/0x90 [ 2582.430236] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2582.430598] RIP: 0033:0x7f76dac9ab19 [ 2582.430866] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2582.432045] RSP: 002b:00007f76d8210188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2582.432551] RAX: ffffffffffffffda RBX: 00007f76dadadf60 RCX: 00007f76dac9ab19 [ 2582.433031] RDX: 0000000000000031 RSI: 0000000020000000 RDI: 0000000000000003 [ 2582.433502] RBP: 00007f76d82101d0 R08: 0000000000000000 R09: 0000000000000000 [ 2582.433974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2582.434441] R13: 00007ffe43c7c20f R14: 00007f76d8210300 R15: 0000000000022000 [ 2582.434933] [ 2582.438090] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2582.438090] program syz-executor.1 not setting count and/or reply_len properly [ 2582.461722] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:25:49 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:25:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320508000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2582.565672] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2582.565672] program syz-executor.0 not setting count and/or reply_len properly 18:26:04 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="324808000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:04 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xf000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:26:04 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0xfffffffffffffed0, 0x0, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1fc, 0x1024a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x5, 0x0, 0x1, 0x0, 0xfffffffe, 0x1, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x7) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000340)=ANY=[]) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:26:04 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320608000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:04 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) (fail_nth: 2) 18:26:04 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x9}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:26:04 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x77, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x4a) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) ftruncate(r1, 0x7b5) ftruncate(r0, 0x7b5) 18:26:04 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2598.155084] FAULT_INJECTION: forcing a failure. [ 2598.155084] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2598.155924] CPU: 1 PID: 11568 Comm: syz-executor.5 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2598.156467] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2598.157039] Call Trace: [ 2598.157222] [ 2598.157389] dump_stack_lvl+0x8f/0xb7 [ 2598.157690] should_fail_ex.cold+0x5/0xa [ 2598.158003] _copy_from_user+0x2e/0x180 [ 2598.158296] sg_write.part.0+0x5f1/0xa90 [ 2598.158601] ? __pfx_sg_write.part.0+0x10/0x10 [ 2598.158954] ? __lock_acquire+0xbad/0x5e70 [ 2598.159284] ? lock_is_held_type+0xdb/0x130 [ 2598.159622] ? inode_security+0x105/0x140 [ 2598.159937] ? avc_policy_seqno+0xd/0x70 [ 2598.160244] ? selinux_file_permission+0x3a/0x510 [ 2598.160587] sg_write+0x88/0xe0 [ 2598.160851] vfs_write+0x2cf/0xd90 [ 2598.161137] ? __pfx_sg_write+0x10/0x10 [ 2598.161434] ? __pfx_vfs_write+0x10/0x10 [ 2598.161754] ? __fget_files+0x270/0x450 [ 2598.162059] ? __fget_light+0xe5/0x280 [ 2598.162353] ksys_write+0x12b/0x260 [ 2598.162634] ? __pfx_ksys_write+0x10/0x10 [ 2598.162944] ? syscall_enter_from_user_mode+0x21/0x50 [ 2598.163325] ? syscall_enter_from_user_mode+0x21/0x50 [ 2598.163685] do_syscall_64+0x3f/0x90 [ 2598.163979] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2598.164365] RIP: 0033:0x7f76dac9ab19 [ 2598.164645] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2598.165931] RSP: 002b:00007f76d8210188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2598.166478] RAX: ffffffffffffffda RBX: 00007f76dadadf60 RCX: 00007f76dac9ab19 [ 2598.166992] RDX: 0000000000000031 RSI: 0000000020000000 RDI: 0000000000000003 [ 2598.167504] RBP: 00007f76d82101d0 R08: 0000000000000000 R09: 0000000000000000 [ 2598.168021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2598.168537] R13: 00007ffe43c7c20f R14: 00007f76d8210300 R15: 0000000000022000 [ 2598.169082] [ 2598.179434] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2598.183235] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2598.183235] program syz-executor.0 not setting count and/or reply_len properly [ 2598.212873] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2598.212873] program syz-executor.1 not setting count and/or reply_len properly [ 2598.239562] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:26:23 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB="00deffffffd400"]) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:26:23 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:26:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0xa}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:26:23 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) (fail_nth: 3) 18:26:23 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320708000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:23 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x10000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:26:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="324c08000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:23 executing program 7: syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) r2 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0xc11a, 0x4, 0x0, 0x163, 0x0, r2}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendfile(r1, r3, 0x0, 0xfffffdef) [ 2616.878082] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2616.878082] program syz-executor.0 not setting count and/or reply_len properly 18:26:23 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320a08000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2616.943588] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2616.954990] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2616.954990] program syz-executor.0 not setting count and/or reply_len properly 18:26:23 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="324808000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2616.994288] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2616.994288] program syz-executor.1 not setting count and/or reply_len properly 18:26:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0xb}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2617.012666] FAULT_INJECTION: forcing a failure. [ 2617.012666] name failslab, interval 1, probability 0, space 0, times 0 [ 2617.014577] CPU: 1 PID: 11611 Comm: syz-executor.5 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2617.015577] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2617.016586] Call Trace: [ 2617.016914] [ 2617.017259] dump_stack_lvl+0x8f/0xb7 [ 2617.017850] should_fail_ex.cold+0x5/0xa [ 2617.018467] should_failslab+0x9/0x20 [ 2617.019028] __kmem_cache_alloc_node+0x5b/0x400 [ 2617.019743] ? blk_rq_map_user_iov+0x239/0x1650 [ 2617.020396] ? perf_trace_lock_acquire+0xfd/0x530 [ 2617.021144] ? blk_rq_map_user_iov+0x239/0x1650 [ 2617.021822] __kmalloc+0x46/0xc0 [ 2617.022344] blk_rq_map_user_iov+0x239/0x1650 [ 2617.023036] ? perf_trace_contention_begin+0xa9/0x390 [ 2617.023857] ? lock_is_held_type+0xdb/0x130 [ 2617.024510] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 2617.025285] ? __pfx_lock_release+0x10/0x10 [ 2617.025855] ? rcu_read_lock_sched_held+0x42/0x80 [ 2617.026476] ? trace_contention_end+0xdc/0x140 [ 2617.027101] blk_rq_map_user_io+0x1ee/0x220 [ 2617.027697] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 2617.028327] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2617.029033] ? memset+0x24/0x50 [ 2617.029494] sg_common_write.constprop.0+0xd84/0x15e0 [ 2617.030190] ? __pfx_sg_common_write.constprop.0+0x10/0x10 [ 2617.030902] ? lock_acquire+0x32/0xc0 [ 2617.031432] sg_write.part.0+0x698/0xa90 [ 2617.031995] ? __pfx_sg_write.part.0+0x10/0x10 [ 2617.032602] ? __lock_acquire+0xbad/0x5e70 [ 2617.033202] ? lock_is_held_type+0xdb/0x130 [ 2617.033788] ? inode_security+0x105/0x140 [ 2617.034342] ? avc_policy_seqno+0xd/0x70 [ 2617.034901] ? selinux_file_permission+0x3a/0x510 [ 2617.035552] sg_write+0x88/0xe0 [ 2617.036026] vfs_write+0x2cf/0xd90 [ 2617.036498] ? __pfx_sg_write+0x10/0x10 [ 2617.037029] ? __pfx_vfs_write+0x10/0x10 [ 2617.037608] ? __fget_files+0x270/0x450 [ 2617.038150] ? __fget_light+0xe5/0x280 [ 2617.038691] ksys_write+0x12b/0x260 [ 2617.039189] ? __pfx_ksys_write+0x10/0x10 [ 2617.039747] ? syscall_enter_from_user_mode+0x21/0x50 [ 2617.040411] ? syscall_enter_from_user_mode+0x21/0x50 [ 2617.041103] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2617.041103] program syz-executor.0 not setting count and/or reply_len properly [ 2617.041118] do_syscall_64+0x3f/0x90 [ 2617.042658] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2617.043326] RIP: 0033:0x7f76dac9ab19 [ 2617.043811] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2617.046039] RSP: 002b:00007f76d8210188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2617.046998] RAX: ffffffffffffffda RBX: 00007f76dadadf60 RCX: 00007f76dac9ab19 [ 2617.047896] RDX: 0000000000000031 RSI: 0000000020000000 RDI: 0000000000000003 [ 2617.048776] RBP: 00007f76d82101d0 R08: 0000000000000000 R09: 0000000000000000 [ 2617.049749] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2617.050636] R13: 00007ffe43c7c20f R14: 00007f76d8210300 R15: 0000000000022000 [ 2617.051556] [ 2617.057411] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:26:23 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="324c08000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="326808000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:23 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2617.101395] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2617.101395] program syz-executor.0 not setting count and/or reply_len properly 18:26:23 executing program 7: r0 = socket$netlink(0x10, 0x3, 0x2) getresgid(&(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280)) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) r3 = syz_open_dev$evdev(&(0x7f00000002c0), 0xffffffffffffffe0, 0x1) r4 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r4}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) r5 = accept4$inet(0xffffffffffffffff, &(0x7f0000000300)={0x2, 0x0, @remote}, &(0x7f0000000380)=0x10, 0x80000) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r6, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r6, 0x400454cd, 0x30c) pipe2(&(0x7f00000003c0)={0xffffffffffffffff}, 0x7000) r8 = syz_io_uring_setup(0x3e1, &(0x7f0000001fc0)={0x0, 0x2ba9, 0xa, 0x3, 0x3a3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002040), &(0x7f0000002080)) syz_io_uring_setup(0x3da7, &(0x7f00000020c0)={0x0, 0x0, 0x4, 0x0, 0x162, 0x0, r8}, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000002140), &(0x7f0000002180)) r9 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000400)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) sendmsg$netlink(r0, &(0x7f0000000440)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)=[{&(0x7f0000000580)={0x13ac, 0x11, 0x800, 0x70bd2a, 0x25dfdbff, "", [@nested={0x1dc, 0x45, 0x0, 0x1, [@typed={0x8, 0x6c, 0x0, 0x0, @ipv4=@local}, @typed={0x8, 0x17, 0x0, 0x0, @fd}, @typed={0x8, 0x36, 0x0, 0x0, @pid}, @generic="35d521f9b048d07b449873fcd5e63843b2b2cca4bb5b9207c1bc0855d277f4ef24ef960f7faf82ff6afb66e8ef7493601e2acbb21d17f9ca0e1b24efb6b69af69b9d8f69cc30abcc05ee70e330544f8a114b03f109c99fa5263dfdf1c5d429a20c52fcc95cb00634ceec405c39de61b73504bffcd00d7241fb702bf9b4377a206a9fd9096ee0f024e9609d8f18c161db9a845b94ee19210f5dabd523f80f174403aae730ee37a731b9cd6b91c20cb49385c7a545d266d4ea3fc1c77b5069b25670da", @typed={0x4, 0x5f}, @typed={0x8, 0x7e, 0x0, 0x0, @ipv4=@broadcast}, @generic="86baed8023fb840810a0709b409aa67106f4d91372da107f793f142b60cbbc349cf5b05bc0741392a2b71036a016a656cb2c3e7b87e68db9b7458ba28a2c23343c57d78be43c9f66a8d9e2b0dc8a5e94d5", @typed={0x14, 0xe, 0x0, 0x0, @ipv6=@private0}, @typed={0x8, 0x68, 0x0, 0x0, @fd=r0}, @generic="644e84dc12ec4ef31c650b10b24e3d709fc14cd47ac0f20d575e2adada095a6943607b0e4863714dc9b2a3b76ab3f6d2e0cb898f364d2e2ff80444877edd77d5cb0360a6d3f4d257be32193c4c82b62a0702402bb21855233d4c56fe2887d40281493fb36efaaf3cb1e63471be8898c636e4b7ce2a1c6b4a33b2890a29ea30c4ed114fc363"]}, @generic="49af82614b7b49de15721e62ffc21d9ef8fe593815b293cc5328126fc06c02a37e887c2776ce4c91b8f72db4db0439a6ce1adc13196e5b1484258270ea759c239b039d830d63a1b6a73985f85f2de881091f3dd3a90ec9e2199425bb9f8f311e841f2e0a5da8da89ddb2bac88f250298af394c8981cf295b487560962565994d820f7637accafcc180b1", @typed={0x8, 0x78, 0x0, 0x0, @pid}, @generic="898b59d33fc663fdbcf7d26cf37d56d481acc0e0fbf07946ece825cb9694ae53ae8943dbba7444d727435c680a350b4616225c50440031f08641f82f90491f5ad88e08d16d899bec4d5b6772b5a63042ccfbd9c1a610b08261", @nested={0x109f, 0x79, 0x0, 0x1, [@typed={0x8, 0x7d, 0x0, 0x0, @ipv4=@empty}, @typed={0x8, 0x63, 0x0, 0x0, @fd=r0}, @generic="0069ce7fff5d1635c7024634a7e850ef5111b58f130d0960e00a4cde7d0ffe59a92b113fe7f289cdfb8e5633c4d5c893eb4d8f6159", @generic="4fcab1b3a36e8a423858b21e6a53b5d4c061119525f89892081bdc22199d09138585c4c2f8480afac19d1471e06c7f15773c7b30c58bfd965dc46582414c233b2548c7e226093bb04a80abda36ac", @generic="13760730b8a2895447e44f6d23a763480573a455a1c70305918fae4540cea81cac5054f4c2158434ed925f978631261a60c1731be85a8486c11e9d197af2e39498565a6a2329b441d1684d7bd1ff5e9b2519166c10e3389edba54a3646feb1918f90f9590a70f0dfa6590df481d2ad7c07035cb403a0eef3aa72e951d11a63a573f3596b2d56bb3881b20d326e58c57179e97aa56671e9b587f66c5d3d2974ab13bdd5e9a7fa2f1d973c61034ada7f76eee9e07c745729de67976d76cc9ef34e12e84faba1c8c258ebec7e72936624952d64b413ae75bf08d6676edb11cbbdee8abf6a9112251e132ff829f506eff000ecd99fccc92881a4c1651c2a7ad21b9b523148eb45470e5a594a8df4cad20d230b45958c4fe7ade6fd226d2d20dd70f36d070b538fed5185d4bbeaf7bba064ce81459dd603394c30ffe953e0487f56b9c02ff323e7f73bc9b91ee83fc16ca7c5c6de4b95c4adb50e15102fb0798ef6310719976c41928ff97fd696c37c33e6d65d2525a8adb8fa33ba61cd52cca91609e5123968fa19c24b44ef731a42585b5bd5043d78c506e4c30aef3ca91fbbb42de32f8fabe8326cc3762e061de09fbfff5fe54a6862b0d485cbe5eb3fde702350b965a0feb43dfa99878eb66f844ed49a517eee1d93d7c92b266bebdc88c82d26db610b9d649dc6d1be667b7ce471acc83a683c7a8f6ccf4a256fe01c7fd4ea7e571f9e74945d14ce3322bf9cbac922e64c06d4b7758880670c77b4e1a99f926f35a16b8e24e2efc8c3203c0b363363f5b72f00545e89afee9a469c5776d117a14ab20b28d39a971196812aa00384a59e80a256fc5e9842bc759354949245e9bb3ccd0f04374d02fcf2647e5257dcd7fba4ab6f3833459721882d1cd69125509327b119e8bd31ede7c519f85483f3c477cb582d22c27ea0846ae108ee0d26edf4b2306f60a17a48b52c576a0ea87d56d946fa9ca08f21d14768c0654d1b91314e90593f54d9528f7bdfd8da6d128ced2b541619a39fa231a40c71e0888ae8f4488daae91c744e0f4bde349e5a354e3aa70f5606720f4d524ec82ac3b9a5581cbf861052e374bf89678786722bf6ff4bd867379c12cbbd3c7b65a1988b3bad1734ce9cb2757f37e06b538be94747cd34bfd3eab51904e3eac63032fb4dd7f321edb421c0127a7c9ddfe7c33ca24666d2047be97ed551543f5876b2aca5721e1ff8d0c88d9b436df39b0602871e67a068f401d2595eebe534ff1e60919e2fc8d04403afffff2685ca6cdc7324d776f6f3d1d8c4871d210a62ecd119f940d4d9ac84a7be7c1519fd4859a25221c95bb5ebb3d3fec5330e56895dc65b08e49c9fae5ef2de66dd321f1a501efe84e28102688e74b501ec0dd3864adcad2ba7172995d23d8e7f13bd62ee75947f8c22e1e544c94cca23af2258121a3a1addbd15e97b1ed69e01efa47b10c87dcf48a45865587ca4d078b4944945544d72c6519b1950053e0836504fc657c4091c111dda0f4869b3bdb9454c496306d73f68720f75f40f21df871ab7cab5a82cabaedfbf83bc5b55f19b507f49c7c34ec7dfbb7731e52923195e12326523727a354f666e95046cfea47f0323c4d4ff13bae431bdfa0f9d966d617d40dbaef81f5a6bc7d292bd877403045d89d67364b279ca9ba88e983d84e4ed5bb8b81bf96efcbafcc579782c26fdbbdaae5cbabdedf6e7b30e44712880e202fc8110537cc144ad60c1739a530962169a22ca40a37d3ad51608d1958f3f8d9dbf1efabb4b63d401ae9adba0612b6bb141925de658579c6d9948cfdaf7f9bb2bc52a6a0e3e71a528863b6cc3c118723f901075c37989e31d64358ab4e8d5e424520724c4252d28dfd9dd8844a51c57abd5f3806b6335e9a59b06ce57d5149dd92d935c94413b75999dc04a1c0465275196670a197dd3f0655337dc42426ba8d40f1009b14e49c1f2d5bbc2094d60c02b2ad06ee1891413c18a1486c9d308b119ff3b0430288bfd022bfff1b9e3874b8665612ba1de2a1ba843bbf37f72a835167eda26b55b27ee1c10027a92132702b93fb0f71192ac1aa12d1be57248f4b498ff47a1f7c0c075154e54773972fbda41ede2b60f72dc53e3dd2891b89e0209613d1fed361d16a2124b0dfba36e54c7abbfc981e68c655d15d6874660471fa781ca3fdbb789ab7966c84e3482adf5bfef391cb3c8d4997989c525eacab6a07e4f71b02bc6e1780ec69e679d18289ed7d132268d6ea0d258cff602735b82339b6b6837e1f6ffe3c10c87814b98a4a0374dfc86a676cf5b1833af863b68f2a36717f61278d3974d1c94bdb98f58e713e45c6958565efec010138eee0bc8485596107bf02732eaa525319b9a5cef7c90c2f666489e0a0768f46f12a0f401dbc30f653e3017d4ce8ad8fa67c6774fd563448695c8a1e9042207aa9341e8a3b62d8515eca4d36a8bc7fb8010c21f5171ec74b7bcc31ca10a7ba4a7d3486415cfdf5c5881c990ae2fcc481ab570e6182da10666ea139251e896e03ebadaa539275241226378e57a54881f59db5000738745da812f26f998a480932c750dbf5d038ff7bb704a6f2f891947da4a39c03dd418b718713cf0ce441c4d24ce70fd2d58b63b96ef2ce1d9d275d4076ad2a2d486ede4ddfdc61e3a4d9c515b55565b43925fccfc776794e4e874849f6e1b4afd8064e2f8276cd5f25c7b6a80ca486d782ecc3837648d1c7b8b26a0e9f01633b0e49f006c04fc5b8b68d44bc13869f232041969f08ac2dce0467c01912f5cbcf8660215a6cd484995a8beef2c324309babb7d3854979e79ef33c515dc65564b35047658afe55b855c7e9e888695968bf35a220673f3c0f3452d077ed0a6c502479d1b66c1baad6b6ed84a748bd6a9f058c162b8854010c8ed79d6b2f141356db9602a0c80d25a8977276e2a4c74c0c248683bdedac9d11eba591a95e281ed463258ddd0e59d265ae10cddfc2502dbf25f40dd79f4375e720ee4e62e9932ca136b811f61fb6071126e3f2f8baa8eb032eaf42d6faf1cd97da7e5c6031aa989d90938514e06182b2f697e62fe4ac459e6009dffb354a85232b76a6b4108e768609616059d6a5df1fcbd4ee4f697eb6471b5e47f0a69a3e6f25b6f2ae0d242830196d33b6666773039ac3c5eafb1186ac5af9cce1a0cb8461be1e2c453ade5c29cf1cda0daa2acedfc78b043d8a3cb701e938b9b87d49f0d8e7002a4d02320f18608831d196cbb91cbfaad217690719ac6dd0bad81a5f1d18239f9b145dc524ef9c6bc05e84d4de2facc108080463229d923e7e53ff925a6c4153f22ef3a0e94123435dcf39b9de6722835fec1692be5021612b53552af2ed589ae54f8b295e8f41f0147446308cab05aa5c525e973d8033bbec342c47445ec67f75e8866fb8f24b930cfaf9ed61671222879f3782869e7dc99300dbf50885ab982c53c49838596bb1854172590992177d4b8901079e495b94c529c8d963fcbce3323ec60698e38f7a3c85d082fc22040f7c18535299ec794f69f38decd0c152121c0fd1ecd626745137ec641788e38785c4c451ef5533acabd05d73e30c969889f502cc9b9fe2103338b078bd0fb98f6444d66088d13248a22ed0ea42e98711177afb2a6ed2d932de020534eee3b672af8e8dd771f5c08b544f55980ecc7d12d92255de69c7e5fde9a3f952454ab0343b4c7a985d19a876c563b4fe65b902b9f30b3ce682e2e2da0317977f0001a9dadd423e0ce5c8541b581b9cc8573d1b82a3158b6661fe0916465cb44151ffdbc13d621abfd26bdd78cf50ea97970f4d0cb3cbd5b74656e9c3fb96a16abe6aa6a67967fea3e2475e4d69991494f8402a7065e0251c2da8d5017d9ae4efcfea9ad0afdbece7b119c782d25127879e1ac6a0606fadb2fbf02a8ffe544a55109fc7593841f0ac277b3630444c7d26e94ab45a3e49e552d8756e951d05a6f34302c87b76d95e7172e2bb305833ef5ab71c25608202520a98c8fa9f7c6895385d46745ae702660cb10b2dc2ffbfb2c0c950a1d49ef4c96c239bb4dd5551e97066de94082706bc82956bb11ea7921143532e21c05e884ebca7658a20a8a70a70b78278bd9c0a7443f02f40c384db21e69c18253965f19ff331c554cfdba6a071a676e9ec8abb29ee990f8047849a4c469bbe413fc36c65cba9138f20c68e9a94660e21d05c9fe2786596884aff5efbdc5d9bb3418bc8e3180271894e51eddf45119355d4dcb83ecc59adec80fda1b73c241eb10a5688625c90a3556a9fcd5b14f8f53cf927ffa730399a6de4130f204f6d964b6f859c0688e480e6f7b595cec6207b522195b74aece111d0f36a46de80574fbfabadb59f651a6662356cee047246d92024dc9a55b49475323a096fe672091ea89666e6e452d2e78f8f0aec13da59acd827996346a8b1574860adb2d5dc7d0d771dfd29d35822778bf457680ade430cad861534e8c79dd9be3c4f89814d5a4ea390288734d316d9621ec59a0010ca428ad4c7f3c911f8f240a90f314eaf3e1399b30ee09983b67efd69eb8dfc91815bf28c7c3df4b2e5518a54847b8cf05d78c824eb9986655b48608b6286cdfbde07669093c9d5c8d0668ce169fea626822d25f8fa582ea0ba52c422dda1e3192c0feffe7c714834c87e1c14bb7a54e21445f1f0c50db6ed87235e698ab479deaa143cb4c7844ff8d032de5080da2ab7165afbc801cad36895b6234e9e5f369e6af2105f879a9d407ee1f944869465929d1d8980948a5d51a4cf05308e53c4f701d077e0d867931bde0917d3cb78030d151df716717eb62f2e2ffc656654a628ef4578fdf75bab563addb7d42836b2c1fa687d3f98673f719088792a94e4b1ee93de998a929e83f5ee34ac61ce886ac9716c2729c9815fecbdaddfa60af8a1b58dc21bb0c9cb732eff779d94fc0cc14fbfb31c5104cafaac186f72330b9efc3482d636543f5fdd86949c0bf566947d5a140330cc8233bd079e352668980a604cad6c09a0a41436c7a04aaa58cd29f88ec77d3fa35ad23ce148479ee2a3561ecae046165e80a7761c841f7e4db88690d76a5d55c87daaac527a6981303e501f4c5a6c2fc87040872d16724710f0458b5abd2c0c76e7e9e72de3c44c8901e1a95e97ca16a1803bba86ec12a3283fae93329d4d300d8ceef077acb500dd699a4e3388773f9ccdbc6ba730ff2366bc34d50d689ef126a386b0c5bcad1324c23ca9099b1a9d49c9ee2bd3f6c2b2729a7b56cb0d3c74f06186f156ed6db3a74de252c4764993b08d103a1144060e8d58d0d52eb2f4e018ea9d2395a67b6be50d06eb144c6d492185ed928875d69bc1bc9cdc568326765edb7432f45ff6bad19f76b537ac9ed7f8c04b45b609deee3599d6b99e60372f18913da7fd46ada485d6b9cb89eac9f9bbe15f851232d2ac236e20467c43a87b01f8170cc164f4aad0d476726eded0fdf98243738cb8f75aeb2ed486a16970551a10aee1418fdaa524c2e35ea75aad1a78e8201eaf9c0fe9080366c3cd9499cadbaf372941ba3a7c3ddca98d3d46ca020781ccd7c0ba7b0581a79451548e843f41579124f16d644db1b5e2d34fff88fe78b130d72fa7a5e1a9c927df362714ab31d4173fd092fbf330c65f7268ab851d4d580492cf6ff5418f2f40ff77d26d60053f433f5841406b74e1ff09b4642bf2d76495e35e735e5f941bbfc8d57cb99cd198c56f2300fef120a67e7b60251ca108fd5f7a11290c587959fa4026a3c3c8a18a20380353e984e92e4b8c47608bf7e8e4045c9764d442a092a", @typed={0x5, 0x44, 0x0, 0x0, @str='\x00'}]}, @typed={0x5, 0x40, 0x0, 0x0, @str='\x00'}, @nested={0x2c, 0x41, 0x0, 0x1, [@typed={0x6, 0x27, 0x0, 0x0, @str='#\x00'}, @typed={0x8, 0x5e, 0x0, 0x0, @fd}, @typed={0x8, 0x1a, 0x0, 0x0, @fd}, @typed={0x8, 0x1a, 0x0, 0x0, @ipv4=@local}, @typed={0x8, 0x1d, 0x0, 0x0, @u32=0x3}]}]}, 0x13ac}, {&(0x7f00000019c0)={0x18c, 0x14, 0x0, 0x70bd27, 0x25dfdbff, "", [@typed={0xfb, 0x78, 0x0, 0x0, @binary="460d2bb297d8477ef01fa3dc1aafa704764a727b9b70c62535552966e155ba00b868311c0c4c963f01a0366cfb4a955e5c3618bac0d4988acaa1d129feeb6578eecb3a66bacbeb670478455c1b4418c096266ddc9f37a4f4c4094d286079a0312d0c94fb77dbc45f8761890ec096471741d86c2349eb0e7ffc8d8d82e94c9fd98185289782a897d254a186dbb72f554e0901509c9af2d916b3c9bb246d654ad3f30b00a2c1a355cf01e4641c4c0375439934e50bca49e756c7ecce0627fe6c8a20c095cab26dc5fd8889614c325aae8498516da1868684a2c25c86d6e73204e1618c9382165e8983d7664d80671580acaecfc226a5f202"}, @generic="4f9c629da005c9c4e89ac8488c77a28c3357ad213f613e366e30ccaaa4fedf059c7ef1628bf0ca74511b4d9d15e394f2da6819074f4b76a956c25e078a0ca73fa10d64eb99f56a5f6f0a495fb7ddc11d4b3ac9297dc890b64a211683c720a72c2a85c528d0a5f2007dfa1f1f93678018c8988d7d62d147022bb7914c16"]}, 0x18c}], 0x2, &(0x7f0000001cc0)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff, r0, r0]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r0, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, r1}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xffffffffffffffff}}}, @rights={{0x34, 0x1, 0x1, [r0, 0xffffffffffffffff, r2, r3, r0, r0, r4, r5, r6]}}, @rights={{0x2c, 0x1, 0x1, [r0, r7, r8, r9, r10, r0, r0]}}], 0x110, 0x20008c0}, 0x8819) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)={0x20, 0x0, 0x4, 0x0, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x6, 0x7a}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x28000}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 18:26:23 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) (fail_nth: 4) [ 2617.203345] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:26:23 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x240b0000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:26:23 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="326808000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:24 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2617.271269] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; 18:26:24 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) (fail_nth: 5) [ 2617.271269] program syz-executor.1 not setting count and/or reply_len properly 18:26:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0xc}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2617.324694] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2617.324694] program syz-executor.0 not setting count and/or reply_len properly 18:26:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="326c08000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2617.431126] FAULT_INJECTION: forcing a failure. [ 2617.431126] name failslab, interval 1, probability 0, space 0, times 0 [ 2617.432603] CPU: 0 PID: 11641 Comm: syz-executor.5 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2617.433665] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2617.434689] Call Trace: [ 2617.435025] [ 2617.435329] dump_stack_lvl+0x8f/0xb7 [ 2617.435856] should_fail_ex.cold+0x5/0xa [ 2617.436401] should_failslab+0x9/0x20 [ 2617.436904] __kmem_cache_alloc_node+0x5b/0x400 [ 2617.437526] ? bio_kmalloc+0x3e/0x70 [ 2617.438027] ? bio_kmalloc+0x3e/0x70 [ 2617.438519] __kmalloc+0x46/0xc0 [ 2617.438981] bio_kmalloc+0x3e/0x70 [ 2617.439468] blk_rq_map_user_iov+0x3f5/0x1650 [ 2617.440054] ? perf_trace_contention_begin+0xa9/0x390 [ 2617.440742] ? lock_is_held_type+0xdb/0x130 [ 2617.441308] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 2617.441940] ? __pfx_lock_release+0x10/0x10 [ 2617.442500] ? rcu_read_lock_sched_held+0x42/0x80 [ 2617.443152] ? trace_contention_end+0xdc/0x140 [ 2617.443768] blk_rq_map_user_io+0x1ee/0x220 [ 2617.444330] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 2617.444962] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2617.445660] ? memset+0x24/0x50 [ 2617.445861] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2617.446097] sg_common_write.constprop.0+0xd84/0x15e0 [ 2617.447923] ? __pfx_sg_common_write.constprop.0+0x10/0x10 [ 2617.448641] ? lock_acquire+0x32/0xc0 [ 2617.449176] sg_write.part.0+0x698/0xa90 [ 2617.449706] ? __pfx_sg_write.part.0+0x10/0x10 [ 2617.450308] ? __lock_acquire+0xbad/0x5e70 [ 2617.450876] ? lock_is_held_type+0xdb/0x130 [ 2617.451447] ? inode_security+0x105/0x140 [ 2617.451993] ? avc_policy_seqno+0xd/0x70 [ 2617.452523] ? selinux_file_permission+0x3a/0x510 [ 2617.453159] sg_write+0x88/0xe0 [ 2617.453616] vfs_write+0x2cf/0xd90 [ 2617.454092] ? __pfx_sg_write+0x10/0x10 [ 2617.454620] ? __pfx_vfs_write+0x10/0x10 [ 2617.455165] ? __fget_files+0x270/0x450 [ 2617.455710] ? __fget_light+0xe5/0x280 [ 2617.456228] ksys_write+0x12b/0x260 [ 2617.456730] ? __pfx_ksys_write+0x10/0x10 [ 2617.457314] ? syscall_enter_from_user_mode+0x21/0x50 [ 2617.457972] ? syscall_enter_from_user_mode+0x21/0x50 [ 2617.458661] do_syscall_64+0x3f/0x90 [ 2617.459160] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2617.459844] RIP: 0033:0x7f76dac9ab19 [ 2617.460326] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2617.462559] RSP: 002b:00007f76d8210188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2617.463513] RAX: ffffffffffffffda RBX: 00007f76dadadf60 RCX: 00007f76dac9ab19 [ 2617.464398] RDX: 0000000000000031 RSI: 0000000020000000 RDI: 0000000000000003 [ 2617.465294] RBP: 00007f76d82101d0 R08: 0000000000000000 R09: 0000000000000000 [ 2617.466179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2617.467059] R13: 00007ffe43c7c20f R14: 00007f76d8210300 R15: 0000000000022000 [ 2617.467960] [ 2617.491936] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2617.544621] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2617.544621] program syz-executor.1 not setting count and/or reply_len properly 18:26:44 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x10000000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:26:44 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32]) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:26:44 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2100000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB="45d209566fc5e31f2e2f66696c653000"]) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:26:44 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="327408000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0xd}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:26:44 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xc00e0000, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2637.704535] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2637.704535] program syz-executor.1 not setting count and/or reply_len properly 18:26:44 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) (fail_nth: 6) 18:26:44 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="326c08000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:26:44 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="327a08000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2637.772636] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2637.784962] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2637.784962] program syz-executor.0 not setting count and/or reply_len properly 18:26:44 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32]) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2637.796807] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.7'. [ 2637.809953] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2637.844294] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2637.844294] program syz-executor.1 not setting count and/or reply_len properly 18:26:44 executing program 7: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:26:44 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) (fail_nth: 7) [ 2637.924145] FAULT_INJECTION: forcing a failure. [ 2637.924145] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2637.924984] CPU: 1 PID: 11682 Comm: syz-executor.5 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2637.925545] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2637.926102] Call Trace: [ 2637.926287] [ 2637.926451] dump_stack_lvl+0x8f/0xb7 [ 2637.926734] should_fail_ex.cold+0x5/0xa [ 2637.927032] copyin+0x19/0x120 [ 2637.927272] _copy_from_iter+0x38b/0x1150 [ 2637.927571] ? trace_rcu_dyntick+0x1a7/0x250 [ 2637.927904] ? __pfx__copy_from_iter+0x10/0x10 [ 2637.928229] ? bio_add_pc_page+0xbc/0x100 [ 2637.928526] ? page_copy_sane+0xd3/0x390 [ 2637.928814] copy_page_from_iter+0xe3/0x180 [ 2637.929117] blk_rq_map_user_iov+0xb0c/0x1650 [ 2637.929453] ? lock_is_held_type+0xdb/0x130 [ 2637.929761] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 2637.930106] ? __pfx_lock_release+0x10/0x10 [ 2637.930413] ? rcu_read_lock_sched_held+0x42/0x80 [ 2637.930748] ? trace_contention_end+0xdc/0x140 [ 2637.931080] blk_rq_map_user_io+0x1ee/0x220 [ 2637.931382] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 2637.931721] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2637.932095] ? memset+0x24/0x50 [ 2637.932342] sg_common_write.constprop.0+0xd84/0x15e0 [ 2637.932719] ? __pfx_sg_common_write.constprop.0+0x10/0x10 [ 2637.933100] ? lock_acquire+0x32/0xc0 [ 2637.933389] sg_write.part.0+0x698/0xa90 [ 2637.933706] ? __pfx_sg_write.part.0+0x10/0x10 [ 2637.934060] ? __lock_acquire+0xbad/0x5e70 [ 2637.934378] ? lock_is_held_type+0xdb/0x130 [ 2637.934713] ? inode_security+0x105/0x140 [ 2637.935039] ? avc_policy_seqno+0xd/0x70 [ 2637.935343] ? selinux_file_permission+0x3a/0x510 [ 2637.935707] sg_write+0x88/0xe0 [ 2637.935954] vfs_write+0x2cf/0xd90 [ 2637.936237] ? __pfx_sg_write+0x10/0x10 [ 2637.936550] ? __pfx_vfs_write+0x10/0x10 [ 2637.936866] ? __fget_files+0x270/0x450 [ 2637.937168] ? __fget_light+0xe5/0x280 [ 2637.937477] ksys_write+0x12b/0x260 [ 2637.937764] ? __pfx_ksys_write+0x10/0x10 [ 2637.938077] ? syscall_enter_from_user_mode+0x21/0x50 [ 2637.938459] ? syscall_enter_from_user_mode+0x21/0x50 [ 2637.938855] do_syscall_64+0x3f/0x90 [ 2637.939146] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2637.939528] RIP: 0033:0x7f76dac9ab19 [ 2637.939808] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2637.941084] RSP: 002b:00007f76d8210188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2637.941636] RAX: ffffffffffffffda RBX: 00007f76dadadf60 RCX: 00007f76dac9ab19 [ 2637.942147] RDX: 0000000000000031 RSI: 0000000020000000 RDI: 0000000000000003 [ 2637.942666] RBP: 00007f76d82101d0 R08: 0000000000000000 R09: 0000000000000000 [ 2637.943182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2637.943685] R13: 00007ffe43c7c20f R14: 00007f76d8210300 R15: 0000000000022000 [ 2637.944211] 18:27:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320009000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="327408000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) (fail_nth: 8) 18:27:03 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0xffffff7f, 0x0}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:03 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0xa0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x1}, 0x8001, 0x1, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:27:03 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32]) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:27:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0xe}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:03 executing program 7: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2656.608511] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2656.608511] program syz-executor.1 not setting count and/or reply_len properly 18:27:03 executing program 7: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:27:03 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320018000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2656.642866] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2656.645696] FAULT_INJECTION: forcing a failure. [ 2656.645696] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2656.646603] CPU: 1 PID: 11697 Comm: syz-executor.5 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2656.647166] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2656.647727] Call Trace: [ 2656.647910] [ 2656.648071] dump_stack_lvl+0x8f/0xb7 [ 2656.648371] should_fail_ex.cold+0x5/0xa [ 2656.648664] _copy_to_user+0x2e/0x150 [ 2656.648940] simple_read_from_buffer+0xd0/0x170 [ 2656.649280] proc_fail_nth_read+0x19c/0x230 [ 2656.649597] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2656.649949] ? security_file_permission+0xb5/0xe0 [ 2656.650306] vfs_read+0x257/0x940 [ 2656.650561] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2656.650909] ? __pfx_vfs_read+0x10/0x10 [ 2656.651189] ? __fget_files+0x270/0x450 [ 2656.651492] ksys_read+0x12b/0x260 [ 2656.651760] ? __pfx_ksys_read+0x10/0x10 [ 2656.652059] ? syscall_enter_from_user_mode+0x21/0x50 [ 2656.652423] ? syscall_enter_from_user_mode+0x21/0x50 [ 2656.652796] do_syscall_64+0x3f/0x90 [ 2656.652958] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2656.652958] program syz-executor.0 not setting count and/or reply_len properly [ 2656.653071] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2656.655432] RIP: 0033:0x7f76dac4d69c [ 2656.655691] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2656.656890] RSP: 002b:00007f76d8210170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2656.657453] RAX: ffffffffffffffda RBX: 0000000000000031 RCX: 00007f76dac4d69c [ 2656.657982] RDX: 000000000000000f RSI: 00007f76d82101e0 RDI: 0000000000000004 [ 2656.658494] RBP: 00007f76d82101d0 R08: 0000000000000000 R09: 0000000000000000 [ 2656.659002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2656.659520] R13: 00007ffe43c7c20f R14: 00007f76d8210300 R15: 0000000000022000 [ 2656.660051] [ 2656.672499] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:27:03 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB]) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:27:03 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x2}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:03 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="327a08000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0xf}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2656.780099] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2656.790137] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2656.790137] program syz-executor.1 not setting count and/or reply_len properly 18:27:03 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1c000851}, 0x28044010) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000340)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB="00000000000000002e2f66696c65300013efe6836303ec34488debc65e61e8b94c16d21ab5273ce5b9d7d8924f49788fed37e4c2cb118dd0ad79c24daff97761bb296ae32017920bdcd1bf30f69cbf0b4edc572765cc277a6759c949ee01aa2e583e5df48f144bdc3fb72c7df7faa62131d68fc200feeb86e3d1ba0d418bb103f68634652ad2e824dca85af86f1065a0faf07f2b5a1aefe1e369a42f7624a842ee069a47182974efc8feeca2063909105b1be127bf07"]) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:27:03 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) [ 2656.819438] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2656.819438] program syz-executor.0 not setting count and/or reply_len properly [ 2656.908666] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:27:18 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB]) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:27:18 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x3}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:18 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x42) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x3}, 0x2100, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000010000000000000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) [ 2672.273479] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; 18:27:18 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="327408000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:18 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14020000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) 18:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="32002f000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x10}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320009000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2672.273479] program syz-executor.1 not setting count and/or reply_len properly 18:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14060000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) [ 2672.302281] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2672.302281] program syz-executor.0 not setting count and/or reply_len properly 18:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320009000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2672.311611] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:27:19 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB]) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:27:19 executing program 7: r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r0, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30c) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) [ 2672.377966] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2672.377966] program syz-executor.1 not setting count and/or reply_len properly [ 2672.382492] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:27:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320018000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:19 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x4}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:19 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14080000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) 18:27:19 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320010000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x300}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2672.476116] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2672.476116] program syz-executor.0 not setting count and/or reply_len properly [ 2672.498494] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2672.498494] program syz-executor.1 not setting count and/or reply_len properly 18:27:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="32002f000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2672.547851] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2672.574097] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2672.574097] program syz-executor.0 not setting count and/or reply_len properly [ 2672.593312] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:27:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x500}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:34 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x4004015) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0}, 0x8000) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000340)={0x3, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000840)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB="0000060088e4d029ae00acf7000000d2215bb2f2de7985e952ba78180cb86d967279a043a937ecb4771fdb168e89d3eec0a1634123db39f2ba8d3acba82f8c1bcdc38568ab37cf7f3f2914c68b3b6a072b9cddb272845b204e97e63b66ff48b38eb4831b1e5a7cd486f9103d76eb9c72f2ff642ca02ab414a4c22c93510755cf58c37abb892c6027dcedc61c477748a3b432c23d2202c1eb787015e27e6f4084225f342966dcc0b7ff96c9c4be1729ddf68dadc8cfea707929eeb9d55c7407a912dc2160765648b2afd1ce1390d5af20ef47f7a781abd1f4622721fc00d2048313078fd2712e128294f75265e90ca3ea88e1ee85cb002ec70611a345d9c6ad4d5b0b30c95c4b2b32dcf1788dfb1507af2895bb033995661011c274812326051bbb5dd759b08ad7ff0e1219b9d5cbd3d22a1378b3d7c477f74bf8d325e01643fcfcbc70485ab80bb58f8eca75e042661585261073a648bfbaf1b242089ba5c6e77bc1e1e2466abab51b5129fe4adedc5d79bea31228847fd8a12f82433f0e86f0224c783b4418c181d072833472d357c517823a9b58d887b6f6ab566ba57b3b2a032a901dd7885a46deb3871ad9be6f58bd40d92ac3cf104127f127a1b2298b485f015406eea3013c6a9c7cc284ab59307c73f8187a38456b40dab24128450d92b94dd998cf960c95d84563fb9d1ddd50596206be8339ea89c48d2949b41a6be8b61441960f9e0d54ffaee590456bf68f4788df75cb99f980f98ad97f37"]) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:27:34 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14090000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) 18:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320018000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320009000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:34 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2687.371548] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2687.371548] program syz-executor.1 not setting count and/or reply_len properly [ 2687.374146] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2687.374146] program syz-executor.0 not setting count and/or reply_len properly 18:27:34 executing program 7: r0 = clone3(0x0, 0x0) waitid(0x2, r0, &(0x7f0000000540), 0x0, &(0x7f00000005c0)) perf_event_open(&(0x7f0000000300)={0x2, 0x80, 0xf8, 0x4, 0x1, 0x10, 0x0, 0x6, 0x4010, 0x4, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x4, 0x1, @perf_bp={&(0x7f0000000180), 0x5}, 0xd012, 0x0, 0x0, 0x4, 0x3, 0x80, 0x9, 0x0, 0x75, 0x0, 0x7}, r0, 0xc, 0xffffffffffffffff, 0xb) r1 = syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000880)='./file1\x00', 0xf43ac2ab228883d6, 0x181) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="7472616e733d669d919a028e37340100000000000a000000", @ANYRESHEX=r2, @ANYBLOB="2c7766743527b9", @ANYRESHEX=r3, @ANYBLOB=',\x00']) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x2a6200, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000200)=0xc) r6 = gettid() setpriority(0x1, r6, 0x0) ioctl$NS_GET_OWNER_UID(r4, 0xb704, &(0x7f00000004c0)=0x0) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000480), 0x160064, &(0x7f0000000680)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@access_any}], [{@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@euid_eq}, {@dont_appraise}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@fsmagic}, {@fowner_eq={'fowner', 0x3d, r7}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'y:&)}*})'}}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x57, 0x37, 0x66, 0x31, 0x62, 0x64, 0x31], 0x2d, [0x39, 0x33, 0x39, 0x62], 0x2d, [0x39, 0x38, 0x51, 0x63], 0x2d, [0x34, 0x33, 0x31, 0x30], 0x2d, [0x36, 0x30, 0x36, 0x64, 0x37, 0x65, 0x37, 0x64]}}}]}}) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x1, 0x3, 0x84, 0x9b, 0x0, 0x8, 0x40000, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0xfffffff7, 0x2, @perf_bp={&(0x7f00000001c0), 0x1}, 0x2009, 0x8, 0x40, 0x7, 0x0, 0x5, 0x3, 0x0, 0x3, 0x0, 0x59}, r6, 0xd, r4, 0x2) ioprio_get$pid(0x3, r5) syz_io_uring_setup(0x324b, &(0x7f00000007c0)={0x0, 0xb2fb, 0x4, 0x3, 0x27f}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000840), &(0x7f00000008c0)) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000240), 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x3c) 18:27:34 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x5}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2687.423309] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2687.423309] program syz-executor.0 not setting count and/or reply_len properly 18:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320010000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="32002f000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2687.454692] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:27:34 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320018000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2687.483586] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2687.483586] program syz-executor.1 not setting count and/or reply_len properly [ 2687.486617] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:27:34 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a140d0000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) 18:27:34 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x6}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:34 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2687.566473] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2687.566473] program syz-executor.0 not setting count and/or reply_len properly [ 2687.605324] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2687.763923] 9pnet: Could not find request transport: f74 [ 2687.834090] 9pnet: Could not find request transport: f74 18:27:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008020042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:50 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x600}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="32002f000042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:50 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x7}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:50 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:27:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a140e0000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) 18:27:50 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0xea3e, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:27:50 executing program 7: socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x1010c2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/diskstats\x00', 0x0, 0x0) r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000500), 0xa0402, 0x0) waitid$P_PIDFD(0x3, r2, &(0x7f0000000540), 0x2, &(0x7f00000005c0)) ioctl$TUNSETLINK(r2, 0x400454cd, 0x30c) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000340)={0x3b4, 0x0, 0x4, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0xa, 0xcd, [0x75, 0x4, 0x0]}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x231}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0xe, 0xcd, [0x1, 0x3, 0x4, 0x9, 0x1]}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_FRAME={0x359, 0x33, @assoc_resp={@wo_ht={{}, {0xff}, @broadcast, @device_a, @random="519a627f670c", {0x5, 0x3}}, 0xc, 0x3, @random=0xa5, @void, @val={0x2d, 0x1a, {0x340, 0x0, 0x1, 0x0, {0x2b, 0x273, 0x0, 0x5, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x300, 0x10001, 0x2}}, [{0xdd, 0x31, "a3c0c298476f41a8d91eb397ba907d7d347cfb8f0c9c34d802231e9ee32f0c43ed695885f642d2b4094f8a86a21546e3fc"}, {0xdd, 0x63, "b7873b8b6bdf2a2708a567f1d3298e579bd61645bf19d909a85c27752233c3781f49d6715fe4acaf6f42ba7a26ef73e6498eab8a4f9f0cd03647852a8f84070604b08a6b74f661a590de0952decfe4f548bc77124b91edd0da603c6f2e88be77f987e7"}, {0xdd, 0x47, "73825856fad9cbbbfffa6f79a4cf52c41af10f45bf7de7b86884a9da581436621ec2bea60dcffe78b415e1cb3c93e7d1b03d71984807d6e1580283ba9cb9cfadd36e7f512e0057"}, {0xdd, 0xc, "b2b4e9739a67ac3037cea6d5"}, {0xdd, 0x6a, "e7f5f9b45337f18715b2b563e28e278d117c35963b1c62c324ca1ddcb4160a5bdc9c043bf54d879be53df37b23c674e4c2bd54a6421a225db324bcad9019168c554c83c10d0d6e752788b791dd2adf1950c9fb2f431589beaec19669223e27e780c0477ff401c24842f0"}, {0xdd, 0xea, "1d21a67eaff7b07dc4dc969d72458a8fd318ac3ff1e3f69ad3a5d12b8bad51299e5077d3541542e69e7eef0ba968ee1b62b15e2a122995cf36f030cd2a6a159689259781ab2ecffaa5c004237bc6389d2d7e569b20c75c35dacf5cea6edf86e3b152c02d937372cefe5039aea0285794b3b590b1fe7dd92bd40bd3e57a80fa7cbe315bec642f2c794e03552509e1d1960d72e94ea0ea196825ca6fc9e7781c59d869f66aa8218f21c1832cf95bf7d25ac5128a21efc17f7b010aca8c9e4f45c73f15acbf1ffe55e0b715abf907e1a5fb7d666789e22f87833f8339b099377c11f10265453c462807f3e7"}, {0xdd, 0x72, "0af981a6dd6796588c6ad4bdd47dba5a6b000de200bf2ef002f05812b45a02d36dcdb61b19b0b31ae3cfb3a0e37a7acc7e8877f92c9da281c49700e95e2b7440d1914dcf12502e5b8fa1aec5c9a6f8b01159c244f109fa00286e54e80ff9d82952e038ca4c9eb6cb819f2edf516f73663541"}, {0xdd, 0x5e, "659f2acb51abd4e69f9231f4091567b858c4de1ddfe6c560f5c98da97a356397abd96d759024bdc2dbad46b6f029057ca854734b460ca4c285ae7c03bb9c520c6c58c844b96c2d40bb7e0fa6f5041141ee9f450135c584df45ea9f68c6d0"}]}}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x3b4}, 0x1, 0x0, 0x0, 0x4044001}, 0x4000000) sendfile(r0, r1, 0x0, 0x10000027f) r3 = gettid() setpriority(0x1, r3, 0x0) r4 = perf_event_open$cgroup(&(0x7f0000000700)={0x2, 0x80, 0x46, 0x5, 0x1, 0xeb, 0x0, 0x7, 0x22018, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0xfffffff8, 0x2, @perf_config_ext={0xfffffffffffffffb, 0x3}, 0x40000, 0xff, 0x3f, 0x5, 0x7f0000000000000, 0x4eabe855, 0x40, 0x0, 0xffffffbf, 0x0, 0xc0}, r2, 0x0, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0x1f, 0x2, 0xd1, 0x3, 0x0, 0x5, 0x89002, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x800, 0x1, @perf_config_ext={0x1ff, 0x7293}, 0xa02, 0x24, 0x40, 0x6, 0x5, 0x80000000, 0x8, 0x0, 0x7, 0x0, 0x101}, r3, 0xd, r4, 0x5) syz_genetlink_get_family_id$fou(&(0x7f0000000300), 0xffffffffffffffff) [ 2703.724207] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2703.724207] program syz-executor.1 not setting count and/or reply_len properly [ 2703.767444] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2703.767444] program syz-executor.0 not setting count and/or reply_len properly [ 2703.776589] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:27:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008030042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2703.794278] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:27:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008020042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:50 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:27:50 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x8}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2703.884704] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2703.884704] program syz-executor.1 not setting count and/or reply_len properly [ 2703.887627] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2703.887627] program syz-executor.0 not setting count and/or reply_len properly [ 2703.909742] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:27:50 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x700}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:27:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008040042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14110000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) 18:27:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008030042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:27:50 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) [ 2704.015769] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2704.015769] program syz-executor.1 not setting count and/or reply_len properly [ 2704.023678] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2704.023678] program syz-executor.0 not setting count and/or reply_len properly [ 2704.086788] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 18:28:07 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008040042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:28:07 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x9}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:28:07 executing program 7: io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x6004000, &(0x7f0000000140)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) io_setup(0x3ff, &(0x7f0000000140)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') sendfile(r0, r1, &(0x7f0000000240)=0x401, 0x7fffffff) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000340)='./file0/file0\x00', 0x100, 0x0) r2 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) sendfile(r3, r0, 0x0, 0xfffffdef) perf_event_open(&(0x7f0000000180)={0x0, 0x80, 0x8, 0x1f, 0x0, 0x5, 0x0, 0xffff, 0x81c00, 0x8, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x10001, 0x400}, 0x828, 0x9, 0xffffff8c, 0x7, 0x7, 0x4, 0x8ff, 0x0, 0x8, 0x0, 0x851}, 0xffffffffffffffff, 0xe, r2, 0x0) 18:28:07 executing program 3: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) syncfs(r1) ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000180)) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000001}, 0x800) mincore(&(0x7f0000ffb000/0x1000)=nil, 0x1000, &(0x7f0000000540)=""/138) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x401, 0x2000000000000000}, 0x1301, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x4803, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="018000000100000018000000", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sysvipc/msg\x00', 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0xb, 0x0, 0xa) mmap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r4, 0x27000000) 18:28:07 executing program 2: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400000, 0x100}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="000204"], 0x18) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000007", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) mount_setattr(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000200)={0x0, 0x0, 0xc0000, {r0}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @multicast2}}}}], 0x28}}], 0x2, 0x0) 18:28:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x900}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) 18:28:07 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14240000000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) 18:28:07 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008050042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) 18:28:07 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f0000000000)="32999a14000600000000007dd33c8b98c47edb00a43fea2b05448e95f86deb5635bdf3616c5486978d4546919d06bd9efa", 0x31) [ 2721.186246] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2721.186246] program syz-executor.0 not setting count and/or reply_len properly [ 2721.188079] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. 18:28:07 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008050042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2721.255587] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2721.264157] sg_write: data in/out 1500/1 bytes for SCSI command 0x6c-- guessing data in; [ 2721.264157] program syz-executor.5 not setting count and/or reply_len properly 18:28:08 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) recvmmsg(r0, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0xa}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYRES32, @ANYRES32, @ANYBLOB="084d01"], 0x24}}, 0x0) [ 2721.269177] ------------[ cut here ]------------ [ 2721.269949] WARNING: CPU: 0 PID: 11877 at lib/iov_iter.c:629 _copy_from_iter+0x2bf/0x1150 [ 2721.271379] Modules linked in: [ 2721.271907] CPU: 0 PID: 11877 Comm: syz-executor.5 Not tainted 6.2.0-rc1-next-20221226 #1 [ 2721.273208] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2721.274476] RIP: 0010:_copy_from_iter+0x2bf/0x1150 [ 2721.275297] Code: 5d 41 5e 41 5f e9 a5 9f 2f 02 e8 9c a3 37 ff be 79 02 00 00 48 c7 c7 80 cb 9e 84 e8 6b 18 5b ff e9 48 fe ff ff e8 81 a3 37 ff <0f> 0b 45 31 f6 eb 87 e8 75 a3 37 ff 31 ff 89 ee e8 3c 9f 37 ff 40 [ 2721.278049] RSP: 0018:ffff8880470975e8 EFLAGS: 00010212 [ 2721.278930] RAX: 000000000000107b RBX: 0000000000000000 RCX: ffffc9000a83b000 [ 2721.279984] RDX: 0000000000040000 RSI: ffffffff821139ff RDI: 0000000000000001 [ 2721.280920] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 2721.284797] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2721.284797] program syz-executor.0 not setting count and/or reply_len properly [ 2721.285522] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888047097818 [ 2721.287435] R13: ffffea000131e800 R14: 00000000000005dc R15: ffff888047097818 [ 2721.288347] FS: 00007f76d8210700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 [ 2721.289361] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2721.290119] CR2: 0000001b2c421000 CR3: 0000000019b62000 CR4: 0000000000350ef0 [ 2721.291032] Call Trace: [ 2721.291368] [ 2721.291674] ? rcu_read_lock_sched_held+0x42/0x80 [ 2721.292336] ? trace_rcu_dyntick+0x1a7/0x250 [ 2721.292921] ? __pfx__copy_from_iter+0x10/0x10 [ 2721.293554] ? bio_add_pc_page+0xbc/0x100 [ 2721.294121] ? page_copy_sane+0xd3/0x390 [ 2721.294659] copy_page_from_iter+0xe3/0x180 [ 2721.295251] blk_rq_map_user_iov+0xb0c/0x1650 [ 2721.295853] ? lock_is_held_type+0xdb/0x130 [ 2721.296457] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 2721.297126] ? __pfx_lock_release+0x10/0x10 [ 2721.297692] ? rcu_read_lock_sched_held+0x42/0x80 [ 2721.298352] ? trace_contention_end+0xdc/0x140 [ 2721.299026] blk_rq_map_user_io+0x1ee/0x220 [ 2721.299595] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 2721.300255] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2721.300950] ? __irq_work_queue_local+0xd2/0x180 [ 2721.301459] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.6'. [ 2721.301597] ? memset+0x24/0x50 [ 2721.302597] sg_common_write.constprop.0+0xd84/0x15e0 [ 2721.303323] ? __pfx_sg_common_write.constprop.0+0x10/0x10 [ 2721.304074] ? _raw_spin_unlock_irqrestore+0x37/0x60 [ 2721.304752] sg_write.part.0+0x698/0xa90 [ 2721.305326] ? __pfx_sg_write.part.0+0x10/0x10 18:28:08 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write(r0, &(0x7f00000000c0)="320008060042290711d752000000000001060000008291f933dece5cd7834c9fa9d39c8aedc1d5380661dc7f97f5503bb2fe9cf2", 0x34) [ 2721.305952] ? __lock_acquire+0xbad/0x5e70 [ 2721.306944] ? lock_is_held_type+0xdb/0x130 [ 2721.307567] ? inode_security+0x105/0x140 [ 2721.308155] ? avc_policy_seqno+0xd/0x70 [ 2721.308701] ? selinux_file_permission+0x3a/0x510 [ 2721.309368] sg_write+0x88/0xe0 [ 2721.309817] vfs_write+0x2cf/0xd90 [ 2721.310330] ? __pfx_sg_write+0x10/0x10 [ 2721.310876] ? __pfx_vfs_write+0x10/0x10 [ 2721.311458] ? __fget_files+0x270/0x450 [ 2721.312030] ? __fget_light+0xe5/0x280 [ 2721.312559] ksys_write+0x12b/0x260 [ 2721.313091] ? __pfx_ksys_write+0x10/0x10 [ 2721.313645] ? syscall_enter_from_user_mode+0x21/0x50 [ 2721.314358] ? syscall_enter_from_user_mode+0x21/0x50 [ 2721.315087] do_syscall_64+0x3f/0x90 [ 2721.315601] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 2721.316310] RIP: 0033:0x7f76dac9ab19 [ 2721.316793] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2721.319029] RSP: 002b:00007f76d8210188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2721.319972] RAX: ffffffffffffffda RBX: 00007f76dadadf60 RCX: 00007f76dac9ab19 [ 2721.320878] RDX: 0000000000000031 RSI: 0000000020000000 RDI: 0000000000000003 [ 2721.321231] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2721.321231] program syz-executor.1 not setting count and/or reply_len properly [ 2721.321764] RBP: 00007f76dacf4f6d R08: 0000000000000000 R09: 0000000000000000 [ 2721.323703] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2721.324618] R13: 00007ffe43c7c20f R14: 00007f76d8210300 R15: 0000000000022000 [ 2721.325546] [ 2721.325857] irq event stamp: 1063 [ 2721.326330] hardirqs last enabled at (1075): [] __up_console_sem+0x78/0x80 [ 2721.327426] hardirqs last disabled at (1086): [] __up_console_sem+0x5d/0x80 [ 2721.328507] softirqs last enabled at (766): [] __irq_exit_rcu+0x11b/0x180 [ 2721.329597] softirqs last disabled at (731): [] __irq_exit_rcu+0x11b/0x180 [ 2721.330705] ---[ end trace 0000000000000000 ]--- [ 2721.405381] sg_write: data in/out 120144348/4 bytes for SCSI command 0xed-- guessing data in; [ 2721.405381] program syz-executor.0 not setting count and/or reply_len properly VM DIAGNOSIS: 18:28:08 Registers: info registers vcpu 0 RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff824796f5 RDI=ffffffff87dc65e0 RBP=ffffffff87dc65a0 RSP=ffff888047096f20 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000030 R11=0000000000000001 R12=0000000000000030 R13=ffffffff87dc65a0 R14=0000000000000010 R15=ffffffff824796e0 RIP=ffffffff8247974d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f76d8210700 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe4cc661b000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe4cc6619000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2c421000 CR3=0000000019b62000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ffffffffffffffffff00000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=ffffffffffffffffffffffffffffffff XMM03=ffffffffffffffffffffffffffffffff XMM04=ffffffffffffffffffffffff00000000 XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000d93 RBX=0000000000000001 RCX=ffffc900011f0000 RDX=0000000000040000 RSI=ffffffff812e469a RDI=0000000000000001 RBP=ffff88804c30f9f8 RSP=ffff88804c30f9c0 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=0000000000000097 R13=ffff8880485a0000 R14=0000000000000200 R15=ffff88804c30fa48 RIP=ffffffff812e469c RFL=00000012 [----A--] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f008cc41700 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe63cfcd4000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe63cfcd2000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000200000c0 CR3=0000000047014000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ffffffffffffffff0000000000000000 XMM01=23232323232323232323232323232323 XMM02=ffffffffffffffffffffffffffffffff XMM03=00000000000000000000000000000000 XMM04=ffffffffffffffff0000000000000000 XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000