Warning: Permanently added '[localhost]:20828' (ECDSA) to the list of known hosts. 2022/09/30 07:02:13 fuzzer started 2022/09/30 07:02:13 dialing manager at localhost:40535 syzkaller login: [ 36.271673] cgroup: Unknown subsys name 'net' [ 36.360260] cgroup: Unknown subsys name 'rlimit' 2022/09/30 07:02:28 syscalls: 204 2022/09/30 07:02:28 code coverage: enabled 2022/09/30 07:02:28 comparison tracing: enabled 2022/09/30 07:02:28 extra coverage: enabled 2022/09/30 07:02:28 setuid sandbox: enabled 2022/09/30 07:02:28 namespace sandbox: enabled 2022/09/30 07:02:28 Android sandbox: enabled 2022/09/30 07:02:28 fault injection: enabled 2022/09/30 07:02:28 leak checking: enabled 2022/09/30 07:02:28 net packet injection: enabled 2022/09/30 07:02:28 net device setup: enabled 2022/09/30 07:02:28 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/09/30 07:02:28 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/09/30 07:02:28 USB emulation: enabled 2022/09/30 07:02:28 hci packet injection: enabled 2022/09/30 07:02:28 wifi device emulation: failed to parse kernel version (6.0.0-rc7-next-20220929) 2022/09/30 07:02:28 802.15.4 emulation: enabled 2022/09/30 07:02:28 fetching corpus: 0, signal 0/0 (executing program) 2022/09/30 07:02:29 starting 8 fuzzer processes 07:02:29 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10) socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640)) setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4) pipe2$9p(&(0x7f00000006c0), 0x80000) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}}) ioctl$TIOCNXCL(r4, 0x540d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'}) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0)) ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000001800)=""/205) 07:02:29 executing program 1: write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4) r2 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0) ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e}) socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) bind$packet(r7, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14) connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0)) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f0000000700)={0x8, 'team0\x00', {'veth0_macvtap\x00'}, 0xff}) socket$packet(0x11, 0x3, 0x300) 07:02:29 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]}) r3 = syz_open_pts(r1, 0x181280) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"}) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1}) sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044094}, 0x0) 07:02:29 executing program 4: openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0) ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7}) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240)) r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)=0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58) clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=0x0) clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58) clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58) r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00)) r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]}) ioctl$TIOCGSOFTCAR(r12, 0x5419, &(0x7f00000010c0)) 07:02:29 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0)) [ 51.700803] audit: type=1400 audit(1664521349.779:6): avc: denied { execmem } for pid=286 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 07:02:29 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]}) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r3, 0x4b36) 07:02:29 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8}) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240)) r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000) setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000012c0)={0x0, 0x1, 0x6, @random="beeef6bfef05"}, 0x10) 07:02:29 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff}) pidfd_open(0xffffffffffffffff, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0) openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000001d00), 0x4202, 0x0) write$snapshot(r6, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) [ 52.904280] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 52.906305] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 52.908615] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 52.909826] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 52.911760] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 52.912982] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 52.917767] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 52.919049] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 52.923175] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 52.924400] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 52.926798] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 52.928117] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 52.936315] Bluetooth: hci1: HCI_REQ-0x0c1a [ 52.938304] Bluetooth: hci0: HCI_REQ-0x0c1a [ 53.000380] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 53.004234] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 53.005771] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 53.026810] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 53.028398] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 53.030190] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 53.032643] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 53.035822] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 53.036840] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 53.037837] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 53.039587] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 53.041252] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 53.043326] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 53.044468] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 53.045861] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 53.058401] Bluetooth: hci2: HCI_REQ-0x0c1a [ 53.060125] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 53.065127] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 53.067338] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 53.074744] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 53.088915] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 53.090581] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 53.092081] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 53.093582] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 53.098635] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 53.108332] Bluetooth: hci6: HCI_REQ-0x0c1a [ 53.109662] Bluetooth: hci5: HCI_REQ-0x0c1a [ 53.111525] Bluetooth: hci7: HCI_REQ-0x0c1a [ 54.990006] Bluetooth: hci4: Opcode 0x c03 failed: -110 [ 54.991694] Bluetooth: hci0: command 0x0409 tx timeout [ 54.992270] Bluetooth: hci1: command 0x0409 tx timeout [ 54.994910] Bluetooth: hci3: Opcode 0x c03 failed: -110 [ 55.117970] Bluetooth: hci7: command 0x0409 tx timeout [ 55.118696] Bluetooth: hci5: command 0x0409 tx timeout [ 55.119209] Bluetooth: hci2: command 0x0409 tx timeout [ 55.183090] Bluetooth: hci6: command 0x0409 tx timeout [ 57.038004] Bluetooth: hci0: command 0x041b tx timeout [ 57.038844] Bluetooth: hci1: command 0x041b tx timeout [ 57.166025] Bluetooth: hci2: command 0x041b tx timeout [ 57.166773] Bluetooth: hci5: command 0x041b tx timeout [ 57.167491] Bluetooth: hci7: command 0x041b tx timeout [ 57.230027] Bluetooth: hci6: command 0x041b tx timeout [ 57.936531] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 57.937849] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 57.939366] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 57.941377] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 57.942674] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 57.943595] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 57.956953] Bluetooth: hci3: HCI_REQ-0x0c1a [ 59.085961] Bluetooth: hci1: command 0x040f tx timeout [ 59.086022] Bluetooth: hci0: command 0x040f tx timeout [ 59.214155] Bluetooth: hci7: command 0x040f tx timeout [ 59.214183] Bluetooth: hci5: command 0x040f tx timeout [ 59.215070] Bluetooth: hci2: command 0x040f tx timeout [ 59.277970] Bluetooth: hci6: command 0x040f tx timeout [ 59.982073] Bluetooth: hci3: command 0x0409 tx timeout [ 60.173966] Bluetooth: hci4: Opcode 0x c03 failed: -110 [ 61.133999] Bluetooth: hci1: command 0x0419 tx timeout [ 61.134447] Bluetooth: hci0: command 0x0419 tx timeout [ 61.261932] Bluetooth: hci5: command 0x0419 tx timeout [ 61.262390] Bluetooth: hci7: command 0x0419 tx timeout [ 61.262945] Bluetooth: hci2: command 0x0419 tx timeout [ 61.326925] Bluetooth: hci6: command 0x0419 tx timeout [ 62.029944] Bluetooth: hci3: command 0x041b tx timeout [ 64.077926] Bluetooth: hci3: command 0x040f tx timeout [ 64.654938] Bluetooth: hci4: Opcode 0x c03 failed: -110 [ 66.125914] Bluetooth: hci3: command 0x0419 tx timeout [ 67.047270] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 67.069416] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 67.074385] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 67.092142] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 67.094423] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 67.096449] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 67.101401] Bluetooth: hci4: HCI_REQ-0x0c1a [ 69.134950] Bluetooth: hci4: command 0x0409 tx timeout [ 71.182973] Bluetooth: hci4: command 0x041b tx timeout [ 73.229938] Bluetooth: hci4: command 0x040f tx timeout [ 75.278927] Bluetooth: hci4: command 0x0419 tx timeout 07:03:19 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff}) pidfd_open(0xffffffffffffffff, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0) openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000001d00), 0x4202, 0x0) write$snapshot(r6, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:03:20 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff}) pidfd_open(0xffffffffffffffff, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0) openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000001d00), 0x4202, 0x0) write$snapshot(r6, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:03:39 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]}) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r3, 0x4b36) 07:03:39 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10) socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640)) setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4) pipe2$9p(&(0x7f00000006c0), 0x80000) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}}) ioctl$TIOCNXCL(r4, 0x540d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'}) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0)) ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000001800)=""/205) 07:03:39 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8}) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240)) r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000) setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000012c0)={0x0, 0x1, 0x6, @random="beeef6bfef05"}, 0x10) 07:03:39 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]}) r3 = syz_open_pts(r1, 0x181280) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"}) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1}) sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044094}, 0x0) 07:03:39 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff}) pidfd_open(0xffffffffffffffff, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0) openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000001d00), 0x4202, 0x0) write$snapshot(r6, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:03:39 executing program 1: write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4) r2 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0) ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e}) socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) bind$packet(r7, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14) connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0)) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f0000000700)={0x8, 'team0\x00', {'veth0_macvtap\x00'}, 0xff}) socket$packet(0x11, 0x3, 0x300) 07:03:39 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0)) 07:03:39 executing program 4: openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0) ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7}) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240)) r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)=0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58) clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=0x0) clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58) clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58) r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00)) r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]}) ioctl$TIOCGSOFTCAR(r12, 0x5419, &(0x7f00000010c0)) 07:03:39 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff}) pidfd_open(0xffffffffffffffff, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0) openat$cgroup_netprio_ifpriomap(r5, &(0x7f0000001cc0), 0x2, 0x0) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:03:39 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff}) pidfd_open(0xffffffffffffffff, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001c80), 0x80080, 0x0) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:03:39 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8}) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240)) r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000) setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000012c0)={0x0, 0x1, 0x6, @random="beeef6bfef05"}, 0x10) 07:03:39 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff}) pidfd_open(0xffffffffffffffff, 0x0) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:03:39 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]}) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r3, 0x4b36) 07:03:39 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]}) r3 = syz_open_pts(r1, 0x181280) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"}) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1}) sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044094}, 0x0) 07:03:39 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000001c40)={0x6, 0x8, 0x7fff}) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:03:39 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8}) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240)) r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000) setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f00000012c0)={0x0, 0x1, 0x6, @random="beeef6bfef05"}, 0x10) 07:03:51 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10) socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640)) setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4) pipe2$9p(&(0x7f00000006c0), 0x80000) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}}) ioctl$TIOCNXCL(r4, 0x540d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'}) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0)) ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000001800)=""/205) 07:03:51 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0)) 07:03:51 executing program 1: write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4) r2 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0) ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e}) socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) bind$packet(r7, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14) connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0)) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f0000000700)={0x8, 'team0\x00', {'veth0_macvtap\x00'}, 0xff}) socket$packet(0x11, 0x3, 0x300) 07:03:51 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]}) r3 = syz_open_pts(r1, 0x181280) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"}) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1}) sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20044094}, 0x0) 07:03:51 executing program 4: openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0) ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7}) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240)) r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)=0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58) clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=0x0) clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58) clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58) r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00)) r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]}) ioctl$TIOCGSOFTCAR(r12, 0x5419, &(0x7f00000010c0)) 07:03:51 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]}) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r3, 0x4b36) 07:03:51 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8}) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240)) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000001280), 0x80000) 07:03:51 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000001c00)=0x9, 0x4) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:05 executing program 1: write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4) r2 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0) ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e}) socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) bind$packet(r7, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14) connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0)) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r6, 0x8982, &(0x7f0000000700)={0x8, 'team0\x00', {'veth0_macvtap\x00'}, 0xff}) socket$packet(0x11, 0x3, 0x300) 07:04:05 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8}) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) ioctl$TIOCGSOFTCAR(r5, 0x5419, &(0x7f0000001240)) 07:04:05 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10) socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640)) setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4) pipe2$9p(&(0x7f00000006c0), 0x80000) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}}) ioctl$TIOCNXCL(r4, 0x540d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'}) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0)) ioctl$KDGKBDIACR(r4, 0x4b4a, &(0x7f0000001800)=""/205) 07:04:05 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:05 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]}) r3 = syz_open_pts(r1, 0x181280) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"}) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000880)={0x4, 0x80, 0x4, 0x1}) 07:04:05 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]}) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208) ioctl$KDENABIO(0xffffffffffffffff, 0x4b36) 07:04:05 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0)) 07:04:05 executing program 4: openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0) ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7}) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240)) r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)=0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58) clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=0x0) clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58) clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58) r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00)) r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]}) ioctl$TIOCGSOFTCAR(r12, 0x5419, &(0x7f00000010c0)) 07:04:05 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) openat$bsg(0xffffffffffffff9c, &(0x7f0000001bc0), 0x20600, 0x0) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:05 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000011c0)={0x3, 0x5bc8}) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:05 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000001b80)) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:05 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$SNAPSHOT_UNFREEZE(0xffffffffffffffff, 0x3302) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:05 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]}) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208) ioctl$KDENABIO(0xffffffffffffffff, 0x4b36) 07:04:05 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r5, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCGETA(r4, 0x5405, &(0x7f0000001180)) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:05 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001a80)={"0b75ee9fc6907b1610c7da34563b9def", r3, 0x0, {0x1f, 0x80000000}, {0xff, 0x80000000}, 0xeb0, [0x200, 0x5, 0xb97, 0x6, 0x5, 0x0, 0x2c7c, 0x3, 0x3, 0xfffffffffffff19d, 0x4, 0xffffffffffffffff, 0x10000, 0x7fff, 0xfffffffffffff000, 0x7]}) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:05 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]}) r3 = syz_open_pts(r1, 0x181280) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000780)={0x3, 0x9, 0x1f, 0x2, 0x15, "7a820cdce7a1f13d678eb8c2cfae0cbec1f6ce"}) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) 07:04:17 executing program 1: write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4) r2 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0) ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e}) socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) bind$packet(r6, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14) connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0)) socket$packet(0x11, 0x3, 0x300) 07:04:17 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000001880)) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:17 executing program 4: openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0) ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7}) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240)) r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)=0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58) clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=0x0) clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58) clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58) r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00)) r12 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0) ioctl$PIO_UNIMAP(r12, 0x4b67, &(0x7f0000001080)={0x3, &(0x7f0000001040)=[{0x5, 0xabec}, {0x401, 0x4}, {0x1, 0x2}]}) 07:04:17 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10) socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640)) setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4) pipe2$9p(&(0x7f00000006c0), 0x80000) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}}) ioctl$TIOCNXCL(r4, 0x540d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'}) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f00000017c0)) 07:04:17 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080) 07:04:17 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r4, 0x4b36) read$snapshot(r2, &(0x7f0000000180)=""/4096, 0x1000) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:17 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]}) syz_open_pts(r1, 0x181280) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) 07:04:17 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]}) semctl$IPC_STAT(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000580)=""/208) ioctl$KDENABIO(0xffffffffffffffff, 0x4b36) 07:04:17 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:17 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000540)={0x1, &(0x7f0000000500)=[{0x1c}]}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r3, 0x4b36) 07:04:17 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$KDENABIO(r4, 0x4b36) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:17 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080) 07:04:17 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:17 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000740)={0x4, &(0x7f0000000700)=[{}, {}, {}, {}]}) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) 07:04:18 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)=0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000480)={0x56, 0x7d, 0x2, {{0x0, 0x40, 0x8, 0x7ff, {0x8, 0x3, 0x4}, 0xcca00000, 0x6, 0x3, 0x0, 0x5, ')\'-)\x9f', 0x3, '):\x00', 0x4, '\xcd+}}', 0x1, '$'}, 0x1, ',', r2, 0xee01, 0xee00}}, 0x56) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r3, 0x4b36) 07:04:18 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:30 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) getresuid(0x0, &(0x7f0000000400), &(0x7f0000000440)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r2, 0x4b36) 07:04:30 executing program 1: write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4) r2 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0) ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e}) socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) bind$packet(r6, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14) connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0)) socket$packet(0x11, 0x3, 0x300) 07:04:30 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10) socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640)) setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4) pipe2$9p(&(0x7f00000006c0), 0x80000) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}}) ioctl$TIOCNXCL(r4, 0x540d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001740)={'vcan0\x00'}) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0) 07:04:30 executing program 4: openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0) ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7}) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240)) r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)=0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58) clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=0x0) clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58) clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58) r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001000)='memory.numa_stat\x00', 0x0, 0x0) 07:04:30 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:30 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) getitimer(0x0, &(0x7f00000006c0)) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) 07:04:30 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCGPTPEER(r3, 0x5441, 0x5) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:30 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) r6 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) sendmsg$GTP_CMD_DELPDP(r6, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x58, r7, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_LINK={0x8, 0x1, r0}, @GTPA_O_TEI={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x20080) 07:04:31 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:31 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:31 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) openat$hpet(0xffffffffffffff9c, &(0x7f0000000700), 0x481040, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0)) 07:04:31 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0, {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) pidfd_open(r1, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r2, 0x4b36) 07:04:31 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000680)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}}, 0x10) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) 07:04:31 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f00000000c0)) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:31 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:31 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) clone3(&(0x7f0000000380)={0x0, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280), {0x1d}, &(0x7f00000002c0)=""/6, 0x6, &(0x7f0000000300)=""/37, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x5}, 0x58) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r1, 0x4b36) 07:04:31 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10) socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640)) setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4) pipe2$9p(&(0x7f00000006c0), 0x80000) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}}) ioctl$TIOCNXCL(r4, 0x540d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0) [ 175.565977] Bluetooth: hci1: command 0x0406 tx timeout [ 175.566154] Bluetooth: hci0: command 0x0406 tx timeout [ 175.566423] Bluetooth: hci2: command 0x0406 tx timeout [ 175.567350] Bluetooth: hci7: command 0x0406 tx timeout [ 175.567686] Bluetooth: hci6: command 0x0406 tx timeout [ 175.568544] Bluetooth: hci5: command 0x0406 tx timeout [ 179.150000] INFO: task rcu_gp:3 blocked for more than 142 seconds. [ 179.151246] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.152187] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.153451] task:rcu_gp state:I stack:30328 pid:3 ppid:2 flags:0x00004000 [ 179.155683] Call Trace: [ 179.156611] [ 179.157063] __schedule+0x893/0x2470 [ 179.157752] ? io_schedule_timeout+0x150/0x150 [ 179.158581] ? do_raw_spin_lock+0x121/0x260 [ 179.159395] ? rwlock_bug.part.0+0x90/0x90 [ 179.160164] schedule+0xda/0x1b0 [ 179.160769] rescuer_thread+0x851/0xdb0 [ 179.161498] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.162376] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.163293] ? lockdep_hardirqs_on+0x79/0x100 [ 179.164047] ? worker_thread+0x1260/0x1260 [ 179.164651] kthread+0x2ed/0x3a0 [ 179.165165] ? kthread_complete_and_exit+0x40/0x40 [ 179.165856] ret_from_fork+0x22/0x30 [ 179.166440] [ 179.166770] INFO: task rcu_par_gp:4 blocked for more than 142 seconds. [ 179.167687] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.168445] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.169505] task:rcu_par_gp state:I stack:30944 pid:4 ppid:2 flags:0x00004000 [ 179.170649] Call Trace: [ 179.171027] [ 179.171368] __schedule+0x893/0x2470 [ 179.171920] ? io_schedule_timeout+0x150/0x150 [ 179.172537] ? do_raw_spin_lock+0x121/0x260 [ 179.173149] ? rwlock_bug.part.0+0x90/0x90 [ 179.173745] schedule+0xda/0x1b0 [ 179.174246] rescuer_thread+0x851/0xdb0 [ 179.174795] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.175498] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.176196] ? lockdep_hardirqs_on+0x79/0x100 [ 179.176809] ? worker_thread+0x1260/0x1260 [ 179.177414] kthread+0x2ed/0x3a0 [ 179.177904] ? kthread_complete_and_exit+0x40/0x40 [ 179.178566] ret_from_fork+0x22/0x30 [ 179.179128] [ 179.179471] INFO: task slub_flushwq:5 blocked for more than 142 seconds. [ 179.180373] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.181092] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.182109] task:slub_flushwq state:I stack:30944 pid:5 ppid:2 flags:0x00004000 [ 179.183229] Call Trace: [ 179.183578] [ 179.183918] __schedule+0x893/0x2470 [ 179.184463] ? io_schedule_timeout+0x150/0x150 [ 179.185127] ? do_raw_spin_lock+0x121/0x260 [ 179.185741] ? rwlock_bug.part.0+0x90/0x90 [ 179.186373] schedule+0xda/0x1b0 [ 179.186889] rescuer_thread+0x851/0xdb0 [ 179.187467] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.188188] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.188913] ? lockdep_hardirqs_on+0x79/0x100 [ 179.189556] ? worker_thread+0x1260/0x1260 [ 179.190203] kthread+0x2ed/0x3a0 [ 179.190691] ? kthread_complete_and_exit+0x40/0x40 [ 179.191491] ret_from_fork+0x22/0x30 [ 179.192068] [ 179.192403] INFO: task netns:6 blocked for more than 142 seconds. [ 179.193263] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.194021] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.195087] task:netns state:I stack:30944 pid:6 ppid:2 flags:0x00004000 [ 179.196264] Call Trace: [ 179.196627] [ 179.196984] __schedule+0x893/0x2470 [ 179.197526] ? io_schedule_timeout+0x150/0x150 [ 179.198188] ? do_raw_spin_lock+0x121/0x260 [ 179.198806] ? rwlock_bug.part.0+0x90/0x90 [ 179.199449] schedule+0xda/0x1b0 [ 179.199970] rescuer_thread+0x851/0xdb0 [ 179.200539] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.201260] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.201988] ? lockdep_hardirqs_on+0x79/0x100 [ 179.202631] ? worker_thread+0x1260/0x1260 [ 179.203265] kthread+0x2ed/0x3a0 [ 179.203754] ? kthread_complete_and_exit+0x40/0x40 [ 179.204465] ret_from_fork+0x22/0x30 [ 179.205040] [ 179.205375] INFO: task kworker/0:0H:8 blocked for more than 142 seconds. [ 179.206311] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.207067] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.208183] task:kworker/0:0H state:I stack:28952 pid:8 ppid:2 flags:0x00004000 [ 179.209355] Workqueue: 0x0 (kblockd) [ 179.209925] Call Trace: [ 179.210285] [ 179.210615] __schedule+0x893/0x2470 [ 179.211190] ? io_schedule_timeout+0x150/0x150 [ 179.211860] schedule+0xda/0x1b0 [ 179.212379] worker_thread+0x15f/0x1260 [ 179.213022] ? process_one_work+0x16a0/0x16a0 [ 179.213673] kthread+0x2ed/0x3a0 [ 179.214206] ? kthread_complete_and_exit+0x40/0x40 [ 179.214928] ret_from_fork+0x22/0x30 [ 179.215507] [ 179.215838] INFO: task mm_percpu_wq:10 blocked for more than 142 seconds. [ 179.216777] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.217536] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.218610] task:mm_percpu_wq state:I stack:30944 pid:10 ppid:2 flags:0x00004000 [ 179.219787] Call Trace: [ 179.220176] [ 179.220505] __schedule+0x893/0x2470 [ 179.221076] ? io_schedule_timeout+0x150/0x150 [ 179.221720] ? do_raw_spin_lock+0x121/0x260 [ 179.222351] ? rwlock_bug.part.0+0x90/0x90 [ 179.223000] schedule+0xda/0x1b0 [ 179.223497] rescuer_thread+0x851/0xdb0 [ 179.224097] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.224801] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.225529] ? lockdep_hardirqs_on+0x79/0x100 [ 179.226194] ? worker_thread+0x1260/0x1260 [ 179.226790] kthread+0x2ed/0x3a0 [ 179.227331] ? kthread_complete_and_exit+0x40/0x40 [ 179.228046] ret_from_fork+0x22/0x30 [ 179.228610] [ 179.228976] INFO: task rcu_tasks_kthre:11 blocked for more than 143 seconds. [ 179.229961] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.230691] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.231779] task:rcu_tasks_kthre state:I stack:29272 pid:11 ppid:2 flags:0x00004000 [ 179.232943] Call Trace: [ 179.233307] [ 179.233633] __schedule+0x893/0x2470 [ 179.234202] ? io_schedule_timeout+0x150/0x150 [ 179.234856] ? mark_held_locks+0x9e/0xe0 [ 179.235474] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.236212] schedule+0xda/0x1b0 [ 179.236704] rcu_tasks_one_gp+0x3db/0xc10 [ 179.237357] rcu_tasks_kthread+0x80/0xa0 [ 179.237969] ? rcu_tasks_postscan+0x10/0x10 [ 179.238580] kthread+0x2ed/0x3a0 [ 179.239099] ? kthread_complete_and_exit+0x40/0x40 [ 179.239819] ret_from_fork+0x22/0x30 [ 179.240400] [ 179.240738] INFO: task kworker/1:0H:21 blocked for more than 143 seconds. [ 179.241669] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.242419] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.243500] task:kworker/1:0H state:I stack:29760 pid:21 ppid:2 flags:0x00004000 [ 179.244662] Workqueue: 0x0 (events_highpri) [ 179.245310] Call Trace: [ 179.245674] [ 179.246025] __schedule+0x893/0x2470 [ 179.246577] ? io_schedule_timeout+0x150/0x150 [ 179.247285] schedule+0xda/0x1b0 [ 179.247777] worker_thread+0x15f/0x1260 [ 179.248391] ? process_one_work+0x16a0/0x16a0 [ 179.249058] kthread+0x2ed/0x3a0 [ 179.249550] ? kthread_complete_and_exit+0x40/0x40 [ 179.250273] ret_from_fork+0x22/0x30 [ 179.250829] [ 179.251530] INFO: task inet_frag_wq:23 blocked for more than 143 seconds. [ 179.252504] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.253257] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.254319] task:inet_frag_wq state:I stack:30704 pid:23 ppid:2 flags:0x00004000 [ 179.255491] Call Trace: [ 179.255856] [ 179.256207] __schedule+0x893/0x2470 [ 179.256753] ? io_schedule_timeout+0x150/0x150 [ 179.257411] ? do_raw_spin_lock+0x121/0x260 [ 179.258043] ? rwlock_bug.part.0+0x90/0x90 [ 179.258654] schedule+0xda/0x1b0 [ 179.259187] rescuer_thread+0x851/0xdb0 [ 179.259758] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.260480] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.261209] ? lockdep_hardirqs_on+0x79/0x100 [ 179.261847] ? worker_thread+0x1260/0x1260 [ 179.262483] kthread+0x2ed/0x3a0 [ 179.262992] ? kthread_complete_and_exit+0x40/0x40 [ 179.263690] ret_from_fork+0x22/0x30 [ 179.264262] [ 179.264594] INFO: task writeback:28 blocked for more than 143 seconds. [ 179.265498] Not tainted 6.0.0-rc7-next-20220929 #1 [ 179.266248] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 179.267322] task:writeback state:I stack:30176 pid:28 ppid:2 flags:0x00004000 [ 179.268481] Call Trace: [ 179.268839] [ 179.269189] __schedule+0x893/0x2470 [ 179.269735] ? io_schedule_timeout+0x150/0x150 [ 179.270405] ? do_raw_spin_lock+0x121/0x260 [ 179.271047] ? rwlock_bug.part.0+0x90/0x90 [ 179.271678] schedule+0xda/0x1b0 [ 179.272194] rescuer_thread+0x851/0xdb0 [ 179.272761] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.273489] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 179.274219] ? lockdep_hardirqs_on+0x79/0x100 [ 179.274893] ? worker_thread+0x1260/0x1260 [ 179.275510] kthread+0x2ed/0x3a0 [ 179.276026] ? kthread_complete_and_exit+0x40/0x40 [ 179.276712] ret_from_fork+0x22/0x30 [ 179.277288] [ 179.277683] [ 179.277683] Showing all locks held in the system: [ 179.278511] 1 lock held by rcu_tasks_kthre/11: [ 179.279120] #0: ffffffff85406890 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc10 [ 179.280415] 1 lock held by khungtaskd/25: [ 179.280968] #0: ffffffff85407360 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 [ 179.282180] 1 lock held by systemd-journal/112: [ 179.282777] 1 lock held by in:imklog/188: [ 179.283339] #0: ffff888008d94368 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe7/0x100 [ 179.284456] 3 locks held by syz-executor/4294: [ 179.285063] [ 179.285296] ============================================= [ 179.285296] [ 183.758030] Bluetooth: hci3: command 0x0406 tx timeout 07:04:44 executing program 1: write$9p(0xffffffffffffffff, &(0x7f0000000000)="094eb78655fa86f1b68c30d0943d81cb9d1eef23ba2c167c6ebc888be1c1a66e6c023992", 0x24) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x1}, 0x7) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000100)={0x50713501}, 0x4) r2 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCMIWAIT(r4, 0x545c, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmsg(r5, &(0x7f0000000440)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)=""/96, 0x60}, {&(0x7f0000000280)=""/182, 0xb6}], 0x2, &(0x7f0000000380)=""/158, 0x9e}, 0x2) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040400}, 0x400000c0) ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000580)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f00000005c0)={0x3, 'macsec0\x00', {0x7fffffff}, 0x9f7e}) socketpair(0x26, 0xa, 0x8, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) bind$packet(r6, &(0x7f0000000640)={0x11, 0xd, r3, 0x1, 0x1, 0x6, @local}, 0x14) connect$packet(r1, &(0x7f0000000680)={0x11, 0xc, r3, 0x1, 0x2, 0x6, @random="aecce1df59e1"}, 0x14) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f00000006c0)) socket$packet(0x11, 0x3, 0x300) 07:04:44 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:44 executing program 4: openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000100)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$cgroup_type(r2, &(0x7f0000000180), 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x200800, 0x0) ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f0000000200)={0x7fff, 0x3f, 0xc1, 0x7, 0x10001, 0x7}) ioctl$TCGETA(0xffffffffffffffff, 0x5405, &(0x7f0000000240)) r4 = clone3(&(0x7f00000006c0)={0x4008000, &(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)=0x0, {0x8}, &(0x7f0000000540)=""/211, 0xd3, &(0x7f0000000640)=""/25, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r1}}, 0x58) clone3(&(0x7f0000000780)={0x10000000, &(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, {0x15}, &(0x7f0000000340)=""/113, 0x71, &(0x7f00000003c0)=""/135, &(0x7f0000000740)=[0xffffffffffffffff, 0x0, 0x0, r4, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x9, {r0}}, 0x58) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000980)=0x0) clone3(&(0x7f0000000c80)={0x40a02000, &(0x7f00000009c0), &(0x7f0000000a00)=0x0, &(0x7f0000000a40), {0x3f}, &(0x7f0000000a80)=""/193, 0xc1, &(0x7f0000000b80)=""/192, &(0x7f0000000c40)=[r6, r8, r5, r7, r4], 0x5, {r1}}, 0x58) clone3(&(0x7f0000000d40)={0x40800200, &(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880), {0x40}, &(0x7f00000008c0)=""/76, 0x4c, &(0x7f0000000940)=""/60, &(0x7f0000000d00)=[r9, r6, r5, r10], 0x4, {r0}}, 0x58) r11 = openat$cgroup_procs(r0, &(0x7f0000000dc0)='tasks\x00', 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r11, 0x81f8943c, &(0x7f0000000e00)) 07:04:44 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x2}, 0x4) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @remote}, 0x10) socketpair(0xa, 0xa, 0x6, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000003c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)=""/207, 0xcf}], 0x1, &(0x7f0000000540)=""/120, 0x78}, 0x40) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x10902, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5419, &(0x7f0000000640)) setsockopt$inet_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000680)={0x1}, 0x4) pipe2$9p(&(0x7f00000006c0), 0x80000) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000700)={{0x0, 0x5, 0x0, 0x9, 0xcb, 0x7ff, 0xff02, 0x8, 0x9, 0xdf6, 0x82, 0x1000, 0x1fc0000000000000, 0x4, 0x3f}}) ioctl$TIOCNXCL(r4, 0x540d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000001700)=0xd76) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001780), 0x2, 0x0) 07:04:44 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:44 executing program 3: openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) ioctl$sock_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, @nfc={0x27, 0x1, 0x1, 0x5}, @tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x0, 0x2}}, @l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}, 0xf91, 0x0, 0x0, 0x0, 0x1d0, &(0x7f0000000040)='dummy0\x00', 0x5, 0x4, 0x800}) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x24, 0x0, 0x0) setsockopt$packet_drop_memb(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000100)={0x0, 0x1, 0x6, @multicast}, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000180)=0x14) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) socketpair(0x18, 0x80000, 0x5, &(0x7f0000000200)={0xffffffffffffffff}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @random="9c1fa74f8bb2"}, 0x10) r3 = socket(0x26, 0x2, 0x3) getpeername$packet(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0xf8, 0x0, 0x1, 0x40, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2096e85c719dd581, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0xa) r5 = socket$inet_icmp(0x2, 0x2, 0x1) recvmsg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)=""/204, 0xcc}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/61, 0x3d}], 0x3, &(0x7f0000000580)=""/225, 0xe1}, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000006c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000000780), r3) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000008c0)) 07:04:44 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) socketpair(0x1e, 0x801, 0x1000, &(0x7f0000000640)) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) 07:04:44 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r1, 0x4b36) 07:04:44 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r1, &(0x7f0000000600)={0x7, 0x21, 0x2}, 0x7) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) 07:04:44 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETS2(r2, 0x402c542b, &(0x7f00000000c0)={0xffff, 0x4, 0x7, 0x1, 0x6, "8a451f3a7976838883bb1ec41c428c47a62f75", 0x2, 0x8}) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:44 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:45 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f00000001c0)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r1, 0x4b36) 07:04:45 executing program 5: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGRS485(r0, 0x542e, &(0x7f0000000000)) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x202) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000080)) syz_open_dev$ttys(0xc, 0x2, 0x1) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000001200)={0x4, 0x2, 0x3, 0x7fff, 0x15, "15aa52ecd1264e6c81f720a2a1f7eb33d4d976"}) 07:04:45 executing program 6: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, &(0x7f00000000c0)={0xd, 0x9}) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000140)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000180)) pidfd_open(0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) ioctl$KDENABIO(r1, 0x4b36) 07:04:45 executing program 7: ioctl$SNDRV_TIMER_IOCTL_STATUS32(0xffffffffffffffff, 0x80585414, &(0x7f0000000000)) write$snapshot(0xffffffffffffffff, &(0x7f0000001d40)="3c71a128dd6d1139ae95350dd5304018f871c6dfdb09bd83aee52eace8bdb5ac09fb8e7459f572efda61dbc02e6c0b5b09ea81c0a4fa5183234cedad31fe47e8ac5f4c80f084552379495f9cbcdb5d2d4329567d7e2506f32cbb388931623e4c3e2ed7ed6fe53c0fb70110745267c2450c6d8806b019396410fa2b", 0x7b) 07:04:45 executing program 2: r0 = request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='\x00', 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') getitimer(0x0, &(0x7f0000000100)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_LINK={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x8000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000240)=""/37) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, &(0x7f0000000280)={0x2, 0x1, 0x9, 0x2, 0xfffffff9}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x936f}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x88}, 0x1, 0x0, 0x0, 0x1080}, 0x841) add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x2}, 0x0, 0x0, r0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x8804}, 0x40400c8) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='blkio.bfq.empty_time\x00', 0x0, 0x0) semctl$GETZCNT(0x0, 0x1, 0xf, &(0x7f00000007c0)=""/151) VM DIAGNOSIS: 07:04:37 Registers: info registers vcpu 0 RAX=ffff8880362eb580 RBX=ffffc90000e91f70 RCX=ffffffff817bd131 RDX=1ffff11006c5d6b0 RSI=0000000000000008 RDI=ffff8880362eb580 RBP=dffffc0000000000 RSP=ffff88802e4a7a98 R8 =0000000000000000 R9 =ffff8880362eb587 R10=ffffed1006c5d6b0 R11=0000000000000001 R12=ffffc90000e91ff9 R13=ffff8880362eb580 R14=0000000000000000 R15=0000000000000086 RIP=ffffffff81785569 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555556a55400 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055797135c648 CR3=000000001d4ce000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM02=0000000000000000 0000000000000000 0000000000000000 413c3fa000000000 YMM03=0000000000000000 0000000000000000 0000ff0000000000 0000000000000000 YMM04=0000000000000000 0000000000000000 732f6c61636f6c2f 7273752f3d485441 YMM05=0000000000000000 0000000000000000 622f6c61636f6c2f 7273752f3a6e6962 YMM06=0000000000000000 0000000000000000 73752f3a6e696273 2f7273752f3a6e69 YMM07=0000000000000000 0000000000000000 6e69622f3a6e6962 732f3a6e69622f72 YMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9 RSI=ffffffff823ba33c RDI=ffffffff8765a9c0 RBP=ffffffff8765a980 RSP=ffff88800902f8a0 R8 =0000000000000001 R9 =ffff88800902f82b R10=ffffed1001205f05 R11=0000000000000001 R12=000000000000001b R13=ffffffff8765a980 R14=ffffffff8765a9d0 R15=ffffffff8765ac30 RIP=ffffffff823ba391 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00005579713b17f0 CR3=00000000177d2000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 00000000005d0546 00000000005d0bad YMM02=0000000000000000 0000000000000000 00000000008a1f4c 00000000005d0546 YMM03=0000000000000000 0000000000000000 00000000004643c1 00000000008a1220 YMM04=0000000000000000 0000000000000000 000000c000ab99f8 000000c000ab99c0 YMM05=0000000000000000 0000000000000000 000000c000ab9a68 000000c000ab9a30 YMM06=0000000000000000 0000000000000000 000000c000ab9ad8 000000c000ab9aa0 YMM07=0000000000000000 0000000000000000 000000c000ab9b48 000000c000ab9b10 YMM08=0000000000000000 0000000000000000 000000c000ab9bb8 000000c000ab9b80 YMM09=0000000000000000 0000000000000000 000000c000ab9c28 000000c000ab9bf0 YMM10=0000000000000000 0000000000000000 000000c000ab9c98 000000c000ab9c60 YMM11=0000000000000000 0000000000000000 000000c000ab9d08 000000c000ab9cd0 YMM12=0000000000000000 0000000000000000 000000c000ab9d78 000000c000ab9d40 YMM13=0000000000000000 0000000000000000 000000c000ab9de8 000000c000ab9db0 YMM14=0000000000000000 0000000000000000 000000c000ab9e58 000000c000ab9e20 YMM15=0000000000000000 0000000000000000 000000c000ab9ec8 000000c000ab9e90