Warning: Permanently added '[localhost]:26956' (ECDSA) to the list of known hosts. 2022/10/03 12:30:57 fuzzer started 2022/10/03 12:30:58 dialing manager at localhost:35095 syzkaller login: [ 44.667872] cgroup: Unknown subsys name 'net' [ 44.781104] cgroup: Unknown subsys name 'rlimit' 2022/10/03 12:31:13 syscalls: 208 2022/10/03 12:31:13 code coverage: enabled 2022/10/03 12:31:13 comparison tracing: enabled 2022/10/03 12:31:13 extra coverage: enabled 2022/10/03 12:31:13 setuid sandbox: enabled 2022/10/03 12:31:13 namespace sandbox: enabled 2022/10/03 12:31:13 Android sandbox: enabled 2022/10/03 12:31:13 fault injection: enabled 2022/10/03 12:31:13 leak checking: enabled 2022/10/03 12:31:13 net packet injection: enabled 2022/10/03 12:31:13 net device setup: enabled 2022/10/03 12:31:13 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/10/03 12:31:13 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/10/03 12:31:13 USB emulation: enabled 2022/10/03 12:31:13 hci packet injection: enabled 2022/10/03 12:31:13 wifi device emulation: failed to parse kernel version (6.0.0-rc7-next-20220930) 2022/10/03 12:31:13 802.15.4 emulation: enabled 2022/10/03 12:31:13 fetching corpus: 0, signal 0/0 (executing program) 2022/10/03 12:31:14 starting 8 fuzzer processes 12:31:14 executing program 0: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x4, 0x2, 0x7}, 0x4}}, 0x18) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x1, 0x4, 0x2}, 0x7fffffff}}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x20000815) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x40080) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000300)={0xb, 0x77, 0x2, 0x8}, 0xb) r3 = socket(0x10, 0x1, 0x101) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000340)={"5d23b2383e7ad8d82206d63b317bdb94", 0x0, 0x0, {0x100000001, 0x100}, {0x2, 0x2}, 0x2, [0x7, 0x1ff, 0x20, 0x8000, 0xf87, 0x9, 0x8, 0x101, 0x9, 0x1, 0x6, 0x100000000, 0x7, 0x9d5, 0xffff, 0xeef]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000440)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000480)={"bafcce709c4a3744791a583033d340ea", r4, r5, {0x400, 0x4608}, {0x4, 0xffffffff}, 0xa5, [0x5b0f, 0x3, 0x4, 0x6, 0xfffffffffffff001, 0x7, 0xffffffffffffff8b, 0x6, 0x3ff, 0x7fff, 0x1, 0x1, 0x9, 0x2, 0xfff, 0xffff]}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000580)=0x800, 0x4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x12}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2}, 0x80) syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r3) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000800)={&(0x7f0000000740), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, r2, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000840)={0x18, 0xd, 0x2, {{0x40, 0x1, 0x1}, 0x9}}, 0x18) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4c804) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000009c0)) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000a00)) 12:31:14 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/172, 0xac, 0x0, &(0x7f00000003c0)=""/4096, 0x1000}, &(0x7f0000001400)=0x40) r4 = shmget(0x3, 0x2000, 0x40, &(0x7f0000ffa000/0x2000)=nil) shmctl$SHM_UNLOCK(r4, 0xc) shmctl$SHM_LOCK(r4, 0xb) shmctl$SHM_LOCK(r2, 0xb) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:31:14 executing program 7: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfc6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xec}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x24008841) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x600a3506b5b96c57}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x590}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x55}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x200c0044) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) socketpair(0xf, 0xa, 0xff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x300, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040810}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000500), 0x259, 0x22600) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"0022d576d5cdfac9a96440af070c389b", 0x0, 0x0, {0x1, 0x3}, {0x0, 0x2}, 0xfff, [0x4, 0x9, 0x7, 0x0, 0x8, 0x3, 0x5, 0x5, 0x8, 0xfe5, 0x4, 0x3ff, 0x7, 0x6, 0x1, 0xfff]}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000700)={&(0x7f0000000640), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048805}, 0x4004080) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), r2) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x805) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000008c0)={'batadv_slave_1\x00'}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r9, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}}, 0x20004805) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_WAIT_SYNC(r9, 0x40089416, &(0x7f0000000a00)=r7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000b80)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000a40)=""/197, 0xc5, 0x0, &(0x7f0000000b40)=""/42, 0x2a}, &(0x7f0000000bc0)=0x40) 12:31:14 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r4, &(0x7f0000001940)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x24, r5, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}}, 0x20881) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f0000001980)=""/201) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f0000001c40)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001c00)={&(0x7f0000001b40)={0xa4, 0x0, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xdd}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x42}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x78}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast1}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8080}, 0xc004) 12:31:14 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) accept4(0xffffffffffffffff, 0x0, &(0x7f00000019c0), 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$CDROMPLAYTRKIND(r0, 0x5304, &(0x7f0000001a00)={0xff, 0x1f, 0x9c, 0x2}) accept4(r3, 0x0, &(0x7f0000001a40), 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000001b40)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x40002}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x1c, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x1c}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) [ 60.489603] audit: type=1400 audit(1664800274.673:6): avc: denied { execmem } for pid=288 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 12:31:14 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r4, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000bc0)='dctcp-reno\x00', 0xb) ioctl$CDROMEJECT_SW(0xffffffffffffffff, 0x530f, 0x0) 12:31:14 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r3, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$CDROMEJECT(r4, 0x5309) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000340)) r5 = syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) ioctl$MON_IOCG_STATS(r5, 0x80089203, &(0x7f00000003c0)) 12:31:14 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) r1 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r2, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r3 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000100)=""/180) r4 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r4, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/127) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000002c0)=""/119) r5 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ff8000/0x4000)=nil) shmctl$SHM_STAT(r5, 0xd, &(0x7f0000000340)=""/189) r6 = shmget(0x3, 0x2000, 0x400, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_INFO(r6, 0x3, &(0x7f0000000400)=""/245) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000500)=""/103) [ 61.745343] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 61.748376] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 61.751576] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 61.759548] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 61.765108] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 61.766664] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 61.777430] Bluetooth: hci0: HCI_REQ-0x0c1a [ 61.803722] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 61.805574] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 61.807947] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 61.809348] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 61.812356] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 61.816389] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 61.821517] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 61.823654] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 61.825949] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 61.827470] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 61.827542] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 61.830333] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 61.835068] Bluetooth: hci2: HCI_REQ-0x0c1a [ 61.846664] Bluetooth: hci1: HCI_REQ-0x0c1a [ 61.877276] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 61.878757] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 61.880271] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 61.884241] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 61.885405] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 61.886499] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 61.888403] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 61.889496] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 61.890769] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 61.898459] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 61.901006] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 61.902199] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 61.903546] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 61.903686] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 61.906355] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 61.908495] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 61.908770] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 61.910073] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 61.911154] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 61.912644] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 61.914058] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 61.914467] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 61.918334] Bluetooth: hci4: HCI_REQ-0x0c1a [ 61.920497] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 61.921806] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 61.928951] Bluetooth: hci3: HCI_REQ-0x0c1a [ 61.929981] Bluetooth: hci7: HCI_REQ-0x0c1a [ 61.960912] Bluetooth: hci6: HCI_REQ-0x0c1a [ 63.831335] Bluetooth: hci0: command 0x0409 tx timeout [ 63.894884] Bluetooth: hci5: Opcode 0x c03 failed: -110 [ 63.895882] Bluetooth: hci2: command 0x0409 tx timeout [ 63.896447] Bluetooth: hci1: command 0x0409 tx timeout [ 63.958970] Bluetooth: hci7: command 0x0409 tx timeout [ 63.959566] Bluetooth: hci4: command 0x0409 tx timeout [ 63.960099] Bluetooth: hci3: command 0x0409 tx timeout [ 64.022915] Bluetooth: hci6: command 0x0409 tx timeout [ 65.878932] Bluetooth: hci0: command 0x041b tx timeout [ 65.943054] Bluetooth: hci1: command 0x041b tx timeout [ 65.943485] Bluetooth: hci2: command 0x041b tx timeout [ 66.006945] Bluetooth: hci3: command 0x041b tx timeout [ 66.007384] Bluetooth: hci4: command 0x041b tx timeout [ 66.007783] Bluetooth: hci7: command 0x041b tx timeout [ 66.070955] Bluetooth: hci6: command 0x041b tx timeout [ 67.926874] Bluetooth: hci0: command 0x040f tx timeout [ 67.990908] Bluetooth: hci2: command 0x040f tx timeout [ 67.990937] Bluetooth: hci1: command 0x040f tx timeout [ 68.054893] Bluetooth: hci7: command 0x040f tx timeout [ 68.054969] Bluetooth: hci4: command 0x040f tx timeout [ 68.055329] Bluetooth: hci3: command 0x040f tx timeout [ 68.118890] Bluetooth: hci6: command 0x040f tx timeout [ 68.566898] Bluetooth: hci5: Opcode 0x c03 failed: -110 [ 69.974858] Bluetooth: hci0: command 0x0419 tx timeout [ 70.038913] Bluetooth: hci1: command 0x0419 tx timeout [ 70.038931] Bluetooth: hci2: command 0x0419 tx timeout [ 70.102945] Bluetooth: hci4: command 0x0419 tx timeout [ 70.102965] Bluetooth: hci3: command 0x0419 tx timeout [ 70.103674] Bluetooth: hci7: command 0x0419 tx timeout [ 70.166921] Bluetooth: hci6: command 0x0419 tx timeout [ 71.062782] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 71.068286] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 71.069778] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 71.078238] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 71.079852] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 71.080620] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 71.088408] Bluetooth: hci5: HCI_REQ-0x0c1a [ 73.111891] Bluetooth: hci5: command 0x0409 tx timeout [ 75.159932] Bluetooth: hci5: command 0x041b tx timeout [ 77.206907] Bluetooth: hci5: command 0x040f tx timeout [ 79.255948] Bluetooth: hci5: command 0x0419 tx timeout 12:32:05 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r4, &(0x7f0000001940)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x24, r5, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}}, 0x20881) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f0000001980)=""/201) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f0000001c40)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001c00)={&(0x7f0000001b40)={0xa4, 0x0, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xdd}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x42}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x78}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast1}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8080}, 0xc004) 12:32:05 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r4, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000bc0)='dctcp-reno\x00', 0xb) ioctl$CDROMEJECT_SW(0xffffffffffffffff, 0x530f, 0x0) 12:32:06 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r4, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000bc0)='dctcp-reno\x00', 0xb) ioctl$CDROMEJECT_SW(0xffffffffffffffff, 0x530f, 0x0) 12:32:06 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r4, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000bc0)='dctcp-reno\x00', 0xb) ioctl$CDROMEJECT_SW(0xffffffffffffffff, 0x530f, 0x0) 12:32:06 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r4, &(0x7f0000001940)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x24, r5, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}}, 0x20881) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f0000001980)=""/201) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f0000001c40)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001c00)={&(0x7f0000001b40)={0xa4, 0x0, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xdd}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x42}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x78}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast1}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8080}, 0xc004) 12:32:06 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) accept4(0xffffffffffffffff, 0x0, &(0x7f00000019c0), 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$CDROMPLAYTRKIND(r0, 0x5304, &(0x7f0000001a00)={0xff, 0x1f, 0x9c, 0x2}) accept4(r3, 0x0, &(0x7f0000001a40), 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000001b40)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x40002}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x1c, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x1c}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:32:06 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) accept4(0xffffffffffffffff, 0x0, &(0x7f00000019c0), 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$CDROMPLAYTRKIND(r0, 0x5304, &(0x7f0000001a00)={0xff, 0x1f, 0x9c, 0x2}) accept4(r3, 0x0, &(0x7f0000001a40), 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000001b40)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x40002}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x1c, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x1c}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:32:06 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r4, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000bc0)='dctcp-reno\x00', 0xb) 12:32:23 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r4, &(0x7f0000001940)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x24, r5, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}}, 0x20881) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f0000001980)=""/201) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f0000001c40)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001c00)={&(0x7f0000001b40)={0xa4, 0x0, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xdd}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x42}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x78}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast1}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x8080}, 0xc004) 12:32:23 executing program 0: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x4, 0x2, 0x7}, 0x4}}, 0x18) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x1, 0x4, 0x2}, 0x7fffffff}}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x20000815) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x40080) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000300)={0xb, 0x77, 0x2, 0x8}, 0xb) r3 = socket(0x10, 0x1, 0x101) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000340)={"5d23b2383e7ad8d82206d63b317bdb94", 0x0, 0x0, {0x100000001, 0x100}, {0x2, 0x2}, 0x2, [0x7, 0x1ff, 0x20, 0x8000, 0xf87, 0x9, 0x8, 0x101, 0x9, 0x1, 0x6, 0x100000000, 0x7, 0x9d5, 0xffff, 0xeef]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000440)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000480)={"bafcce709c4a3744791a583033d340ea", r4, r5, {0x400, 0x4608}, {0x4, 0xffffffff}, 0xa5, [0x5b0f, 0x3, 0x4, 0x6, 0xfffffffffffff001, 0x7, 0xffffffffffffff8b, 0x6, 0x3ff, 0x7fff, 0x1, 0x1, 0x9, 0x2, 0xfff, 0xffff]}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000580)=0x800, 0x4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x12}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2}, 0x80) syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r3) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000800)={&(0x7f0000000740), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, r2, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000840)={0x18, 0xd, 0x2, {{0x40, 0x1, 0x1}, 0x9}}, 0x18) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4c804) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000009c0)) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000a00)) 12:32:23 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) r1 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r2, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r3 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000100)=""/180) r4 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r4, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/127) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000002c0)=""/119) r5 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ff8000/0x4000)=nil) shmctl$SHM_STAT(r5, 0xd, &(0x7f0000000340)=""/189) r6 = shmget(0x3, 0x2000, 0x400, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_INFO(r6, 0x3, &(0x7f0000000400)=""/245) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000500)=""/103) 12:32:23 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/172, 0xac, 0x0, &(0x7f00000003c0)=""/4096, 0x1000}, &(0x7f0000001400)=0x40) r4 = shmget(0x3, 0x2000, 0x40, &(0x7f0000ffa000/0x2000)=nil) shmctl$SHM_UNLOCK(r4, 0xc) shmctl$SHM_LOCK(r4, 0xb) shmctl$SHM_LOCK(r2, 0xb) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:32:23 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r3, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$CDROMEJECT(r4, 0x5309) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000340)) r5 = syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) ioctl$MON_IOCG_STATS(r5, 0x80089203, &(0x7f00000003c0)) 12:32:23 executing program 7: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfc6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xec}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x24008841) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x600a3506b5b96c57}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x590}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x55}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x200c0044) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) socketpair(0xf, 0xa, 0xff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x300, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040810}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000500), 0x259, 0x22600) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"0022d576d5cdfac9a96440af070c389b", 0x0, 0x0, {0x1, 0x3}, {0x0, 0x2}, 0xfff, [0x4, 0x9, 0x7, 0x0, 0x8, 0x3, 0x5, 0x5, 0x8, 0xfe5, 0x4, 0x3ff, 0x7, 0x6, 0x1, 0xfff]}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000700)={&(0x7f0000000640), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048805}, 0x4004080) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), r2) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x805) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000008c0)={'batadv_slave_1\x00'}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r9, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}}, 0x20004805) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_WAIT_SYNC(r9, 0x40089416, &(0x7f0000000a00)=r7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000b80)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000a40)=""/197, 0xc5, 0x0, &(0x7f0000000b40)=""/42, 0x2a}, &(0x7f0000000bc0)=0x40) 12:32:23 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) accept4(0xffffffffffffffff, 0x0, &(0x7f00000019c0), 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$CDROMPLAYTRKIND(r0, 0x5304, &(0x7f0000001a00)={0xff, 0x1f, 0x9c, 0x2}) accept4(r3, 0x0, &(0x7f0000001a40), 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000001b40)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x40002}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x1c, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x1c}}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:32:23 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r4, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:32:23 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/172, 0xac, 0x0, &(0x7f00000003c0)=""/4096, 0x1000}, &(0x7f0000001400)=0x40) r4 = shmget(0x3, 0x2000, 0x40, &(0x7f0000ffa000/0x2000)=nil) shmctl$SHM_UNLOCK(r4, 0xc) shmctl$SHM_LOCK(r4, 0xb) shmctl$SHM_LOCK(r2, 0xb) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:32:23 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) write$tcp_mem(0xffffffffffffffff, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:32:23 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) r3 = accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) accept4(0xffffffffffffffff, 0x0, &(0x7f00000019c0), 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$CDROMPLAYTRKIND(r0, 0x5304, &(0x7f0000001a00)={0xff, 0x1f, 0x9c, 0x2}) accept4(r3, 0x0, &(0x7f0000001a40), 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:32:24 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/172, 0xac, 0x0, &(0x7f00000003c0)=""/4096, 0x1000}, &(0x7f0000001400)=0x40) r4 = shmget(0x3, 0x2000, 0x40, &(0x7f0000ffa000/0x2000)=nil) shmctl$SHM_UNLOCK(r4, 0xc) shmctl$SHM_LOCK(r4, 0xb) shmctl$SHM_LOCK(r2, 0xb) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:32:24 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) r1 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r2, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r3 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000100)=""/180) r4 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r4, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/127) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000002c0)=""/119) r5 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ff8000/0x4000)=nil) shmctl$SHM_STAT(r5, 0xd, &(0x7f0000000340)=""/189) r6 = shmget(0x3, 0x2000, 0x400, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_INFO(r6, 0x3, &(0x7f0000000400)=""/245) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000500)=""/103) 12:32:24 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r3, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$CDROMEJECT(r4, 0x5309) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000340)) r5 = syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) ioctl$MON_IOCG_STATS(r5, 0x80089203, &(0x7f00000003c0)) 12:32:24 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) write$tcp_mem(0xffffffffffffffff, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:32:24 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) accept4(0xffffffffffffffff, 0x0, &(0x7f00000019c0), 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$CDROMPLAYTRKIND(r0, 0x5304, &(0x7f0000001a00)={0xff, 0x1f, 0x9c, 0x2}) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:32:36 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000001940)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x24, r4, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}}, 0x20881) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f0000001980)=""/201) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) 12:32:36 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r3, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$CDROMEJECT(r4, 0x5309) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000340)) r5 = syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) ioctl$MON_IOCG_STATS(r5, 0x80089203, &(0x7f00000003c0)) 12:32:36 executing program 7: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfc6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xec}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x24008841) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x600a3506b5b96c57}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x590}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x55}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x200c0044) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) socketpair(0xf, 0xa, 0xff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x300, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040810}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000500), 0x259, 0x22600) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"0022d576d5cdfac9a96440af070c389b", 0x0, 0x0, {0x1, 0x3}, {0x0, 0x2}, 0xfff, [0x4, 0x9, 0x7, 0x0, 0x8, 0x3, 0x5, 0x5, 0x8, 0xfe5, 0x4, 0x3ff, 0x7, 0x6, 0x1, 0xfff]}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000700)={&(0x7f0000000640), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048805}, 0x4004080) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), r2) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x805) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000008c0)={'batadv_slave_1\x00'}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r9, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}}, 0x20004805) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_WAIT_SYNC(r9, 0x40089416, &(0x7f0000000a00)=r7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000b80)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000a40)=""/197, 0xc5, 0x0, &(0x7f0000000b40)=""/42, 0x2a}, &(0x7f0000000bc0)=0x40) 12:32:36 executing program 0: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x4, 0x2, 0x7}, 0x4}}, 0x18) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x1, 0x4, 0x2}, 0x7fffffff}}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x20000815) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x40080) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000300)={0xb, 0x77, 0x2, 0x8}, 0xb) r3 = socket(0x10, 0x1, 0x101) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000340)={"5d23b2383e7ad8d82206d63b317bdb94", 0x0, 0x0, {0x100000001, 0x100}, {0x2, 0x2}, 0x2, [0x7, 0x1ff, 0x20, 0x8000, 0xf87, 0x9, 0x8, 0x101, 0x9, 0x1, 0x6, 0x100000000, 0x7, 0x9d5, 0xffff, 0xeef]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000440)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000480)={"bafcce709c4a3744791a583033d340ea", r4, r5, {0x400, 0x4608}, {0x4, 0xffffffff}, 0xa5, [0x5b0f, 0x3, 0x4, 0x6, 0xfffffffffffff001, 0x7, 0xffffffffffffff8b, 0x6, 0x3ff, 0x7fff, 0x1, 0x1, 0x9, 0x2, 0xfff, 0xffff]}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000580)=0x800, 0x4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x12}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2}, 0x80) syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r3) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000800)={&(0x7f0000000740), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, r2, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000840)={0x18, 0xd, 0x2, {{0x40, 0x1, 0x1}, 0x9}}, 0x18) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4c804) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000009c0)) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000a00)) 12:32:36 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/172, 0xac, 0x0, &(0x7f00000003c0)=""/4096, 0x1000}, &(0x7f0000001400)=0x40) r4 = shmget(0x3, 0x2000, 0x40, &(0x7f0000ffa000/0x2000)=nil) shmctl$SHM_UNLOCK(r4, 0xc) shmctl$SHM_LOCK(r4, 0xb) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:32:36 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) r1 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r2, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r3 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000100)=""/180) r4 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r4, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/127) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000002c0)=""/119) r5 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ff8000/0x4000)=nil) shmctl$SHM_STAT(r5, 0xd, &(0x7f0000000340)=""/189) r6 = shmget(0x3, 0x2000, 0x400, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_INFO(r6, 0x3, &(0x7f0000000400)=""/245) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000500)=""/103) 12:32:36 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) accept4(0xffffffffffffffff, 0x0, &(0x7f00000019c0), 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:32:36 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = accept4(r2, 0x0, &(0x7f00000009c0), 0x800) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x38, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @local}, @GTPA_NET_NS_FD={0x8}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040001}, 0x800) write$tcp_mem(0xffffffffffffffff, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:32:48 executing program 7: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfc6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xec}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x24008841) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x600a3506b5b96c57}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x590}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x55}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x200c0044) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) socketpair(0xf, 0xa, 0xff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x300, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040810}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000500), 0x259, 0x22600) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"0022d576d5cdfac9a96440af070c389b", 0x0, 0x0, {0x1, 0x3}, {0x0, 0x2}, 0xfff, [0x4, 0x9, 0x7, 0x0, 0x8, 0x3, 0x5, 0x5, 0x8, 0xfe5, 0x4, 0x3ff, 0x7, 0x6, 0x1, 0xfff]}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000700)={&(0x7f0000000640), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048805}, 0x4004080) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), r2) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x805) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000008c0)={'batadv_slave_1\x00'}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r9, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}}, 0x20004805) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_WAIT_SYNC(r9, 0x40089416, &(0x7f0000000a00)=r7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000b80)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000a40)=""/197, 0xc5, 0x0, &(0x7f0000000b40)=""/42, 0x2a}, &(0x7f0000000bc0)=0x40) 12:32:48 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) accept4(r2, 0x0, &(0x7f00000009c0), 0x800) r3 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r3, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:32:48 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000001940)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001900)={&(0x7f00000018c0)={0x24, r4, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}}, 0x20881) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) 12:32:48 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) r1 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r2, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r3 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000100)=""/180) r4 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r4, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/127) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000002c0)=""/119) r5 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ff8000/0x4000)=nil) shmctl$SHM_STAT(r5, 0xd, &(0x7f0000000340)=""/189) r6 = shmget(0x3, 0x2000, 0x400, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_INFO(r6, 0x3, &(0x7f0000000400)=""/245) 12:32:48 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) accept4(0xffffffffffffffff, 0x0, &(0x7f00000019c0), 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:32:48 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/172, 0xac, 0x0, &(0x7f00000003c0)=""/4096, 0x1000}, &(0x7f0000001400)=0x40) r4 = shmget(0x3, 0x2000, 0x40, &(0x7f0000ffa000/0x2000)=nil) shmctl$SHM_UNLOCK(r4, 0xc) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:32:48 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r3 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r3, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) r4 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$CDROMEJECT(r4, 0x5309) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000340)) syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) 12:32:48 executing program 0: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x4, 0x2, 0x7}, 0x4}}, 0x18) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x1, 0x4, 0x2}, 0x7fffffff}}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x20000815) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x40080) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000300)={0xb, 0x77, 0x2, 0x8}, 0xb) r3 = socket(0x10, 0x1, 0x101) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000340)={"5d23b2383e7ad8d82206d63b317bdb94", 0x0, 0x0, {0x100000001, 0x100}, {0x2, 0x2}, 0x2, [0x7, 0x1ff, 0x20, 0x8000, 0xf87, 0x9, 0x8, 0x101, 0x9, 0x1, 0x6, 0x100000000, 0x7, 0x9d5, 0xffff, 0xeef]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000440)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000480)={"bafcce709c4a3744791a583033d340ea", r4, r5, {0x400, 0x4608}, {0x4, 0xffffffff}, 0xa5, [0x5b0f, 0x3, 0x4, 0x6, 0xfffffffffffff001, 0x7, 0xffffffffffffff8b, 0x6, 0x3ff, 0x7fff, 0x1, 0x1, 0x9, 0x2, 0xfff, 0xffff]}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000580)=0x800, 0x4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x12}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2}, 0x80) syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r3) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000800)={&(0x7f0000000740), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, r2, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000840)={0x18, 0xd, 0x2, {{0x40, 0x1, 0x1}, 0x9}}, 0x18) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4c804) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000009c0)) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000a00)) 12:32:48 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x3c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_O_TEI={0x8}, @GTPA_LINK={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r0}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40014) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:32:48 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) r1 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r2, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r3 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000100)=""/180) r4 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r4, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/127) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000002c0)=""/119) r5 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ff8000/0x4000)=nil) shmctl$SHM_STAT(r5, 0xd, &(0x7f0000000340)=""/189) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) 12:32:49 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/172, 0xac, 0x0, &(0x7f00000003c0)=""/4096, 0x1000}, &(0x7f0000001400)=0x40) shmget(0x3, 0x2000, 0x40, &(0x7f0000ffa000/0x2000)=nil) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:32:49 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r3, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:33:00 executing program 0: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x4, 0x2, 0x7}, 0x4}}, 0x18) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x1, 0x4, 0x2}, 0x7fffffff}}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x20000815) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x40080) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000300)={0xb, 0x77, 0x2, 0x8}, 0xb) r3 = socket(0x10, 0x1, 0x101) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000340)={"5d23b2383e7ad8d82206d63b317bdb94", 0x0, 0x0, {0x100000001, 0x100}, {0x2, 0x2}, 0x2, [0x7, 0x1ff, 0x20, 0x8000, 0xf87, 0x9, 0x8, 0x101, 0x9, 0x1, 0x6, 0x100000000, 0x7, 0x9d5, 0xffff, 0xeef]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000440)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000480)={"bafcce709c4a3744791a583033d340ea", r4, r5, {0x400, 0x4608}, {0x4, 0xffffffff}, 0xa5, [0x5b0f, 0x3, 0x4, 0x6, 0xfffffffffffff001, 0x7, 0xffffffffffffff8b, 0x6, 0x3ff, 0x7fff, 0x1, 0x1, 0x9, 0x2, 0xfff, 0xffff]}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000580)=0x800, 0x4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x12}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2}, 0x80) syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r3) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000800)={&(0x7f0000000740), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, r2, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000840)={0x18, 0xd, 0x2, {{0x40, 0x1, 0x1}, 0x9}}, 0x18) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4c804) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000009c0)) 12:33:00 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) ioctl$CDROMREADMODE2(r0, 0x530c, &(0x7f0000000e40)={0x9e, 0x0, 0x0, 0xf2, 0x9, 0xe2}) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:33:00 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r2, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$CDROMEJECT(r3, 0x5309) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) 12:33:00 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000013c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/172, 0xac, 0x0, &(0x7f00000003c0)=""/4096, 0x1000}, &(0x7f0000001400)=0x40) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:33:00 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f0000000800)={0x108, 0x464, 0x400, 0x70bd28, 0x25dfdbfc, "7a7860ca7f244685ef5980e1926f8e2d6707eaddd12ef12779834bc3ece483c67ee3eb5aaa0474ced606107dbdc74ed3b2824f5cabe66e203c255cab4b3a185a8af3815d438a104aeeaa3e595128d1754c667e5b78696174ba6b1c7becbdad3479d3a5f0e10621343600f2d5e1d47eb99f96aec529bef2bde7e0114e611990d607c610c4dda5d37c1e6c7c2287947577be095233afc2635d2ac7cdc266a6dff94139b55df627f3d9a5648f07803ae245ec9136066283dea0005a1a3298bad88784eb42043cbc6d0101121fb079eeaeeb2f252ed9b3fff227b2077a3c21ac19e6e378ad6497368fe98eae393abd26f1dc3ce284015c", ["", "", "", "", "", "", "", "", ""]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r3 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r3, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:33:00 executing program 7: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfc6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xec}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x24008841) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x600a3506b5b96c57}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x590}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x55}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x200c0044) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) socketpair(0xf, 0xa, 0xff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x300, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040810}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000500), 0x259, 0x22600) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"0022d576d5cdfac9a96440af070c389b", 0x0, 0x0, {0x1, 0x3}, {0x0, 0x2}, 0xfff, [0x4, 0x9, 0x7, 0x0, 0x8, 0x3, 0x5, 0x5, 0x8, 0xfe5, 0x4, 0x3ff, 0x7, 0x6, 0x1, 0xfff]}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000700)={&(0x7f0000000640), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048805}, 0x4004080) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), r2) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x805) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000008c0)={'batadv_slave_1\x00'}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r9, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}}, 0x20004805) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_WAIT_SYNC(r9, 0x40089416, &(0x7f0000000a00)=r7) 12:33:00 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)) syz_genetlink_get_family_id$gtp(&(0x7f0000001880), 0xffffffffffffffff) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) 12:33:00 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) r1 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r2, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r3 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000100)=""/180) r4 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r4, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/127) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000002c0)=""/119) shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ff8000/0x4000)=nil) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) 12:33:00 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) socket$nl_audit(0x10, 0x3, 0x9) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:33:00 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) r1 = shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r2, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r3 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000100)=""/180) r4 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r4, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000240)=""/127) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000002c0)=""/119) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) 12:33:00 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/52) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:33:00 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r3, 0x0) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:33:00 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) socket$nl_audit(0x10, 0x3, 0x9) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:33:00 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) r2 = socket$nl_audit(0x10, 0x3, 0x9) accept4(r2, &(0x7f0000000d80)=@isdn, &(0x7f0000000e00)=0x80, 0x800) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:33:00 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r1 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r1, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f0000000100)=""/180) r3 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r3, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000240)=""/127) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) 12:33:00 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r2, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) r3 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$CDROMEJECT(r3, 0x5309) syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) 12:33:00 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) 12:33:00 executing program 0: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x4, 0x2, 0x7}, 0x4}}, 0x18) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x1, 0x4, 0x2}, 0x7fffffff}}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x20000815) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x40080) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000300)={0xb, 0x77, 0x2, 0x8}, 0xb) r3 = socket(0x10, 0x1, 0x101) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000340)={"5d23b2383e7ad8d82206d63b317bdb94", 0x0, 0x0, {0x100000001, 0x100}, {0x2, 0x2}, 0x2, [0x7, 0x1ff, 0x20, 0x8000, 0xf87, 0x9, 0x8, 0x101, 0x9, 0x1, 0x6, 0x100000000, 0x7, 0x9d5, 0xffff, 0xeef]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000440)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000480)={"bafcce709c4a3744791a583033d340ea", r4, r5, {0x400, 0x4608}, {0x4, 0xffffffff}, 0xa5, [0x5b0f, 0x3, 0x4, 0x6, 0xfffffffffffff001, 0x7, 0xffffffffffffff8b, 0x6, 0x3ff, 0x7fff, 0x1, 0x1, 0x9, 0x2, 0xfff, 0xffff]}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000580)=0x800, 0x4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x12}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2}, 0x80) syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r3) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000800)={&(0x7f0000000740), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, r2, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000840)={0x18, 0xd, 0x2, {{0x40, 0x1, 0x1}, 0x9}}, 0x18) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4c804) 12:33:00 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r1 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r1, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f0000000100)=""/180) r3 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_INFO(r3, 0xe, &(0x7f00000001c0)=""/117) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) 12:33:00 executing program 7: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfc6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xec}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x24008841) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x600a3506b5b96c57}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x590}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x55}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x200c0044) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) socketpair(0xf, 0xa, 0xff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x300, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040810}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000500), 0x259, 0x22600) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"0022d576d5cdfac9a96440af070c389b", 0x0, 0x0, {0x1, 0x3}, {0x0, 0x2}, 0xfff, [0x4, 0x9, 0x7, 0x0, 0x8, 0x3, 0x5, 0x5, 0x8, 0xfe5, 0x4, 0x3ff, 0x7, 0x6, 0x1, 0xfff]}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000700)={&(0x7f0000000640), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048805}, 0x4004080) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), r2) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x805) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000008c0)={'batadv_slave_1\x00'}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r9, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x1c}}, 0x20004805) ioctl$BTRFS_IOC_WAIT_SYNC(r9, 0x40089416, &(0x7f0000000a00)=r7) 12:33:12 executing program 7: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfc6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xec}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x24008841) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x600a3506b5b96c57}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x590}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x55}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x200c0044) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) socketpair(0xf, 0xa, 0xff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x300, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040810}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000500), 0x259, 0x22600) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"0022d576d5cdfac9a96440af070c389b", 0x0, 0x0, {0x1, 0x3}, {0x0, 0x2}, 0xfff, [0x4, 0x9, 0x7, 0x0, 0x8, 0x3, 0x5, 0x5, 0x8, 0xfe5, 0x4, 0x3ff, 0x7, 0x6, 0x1, 0xfff]}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000700)={&(0x7f0000000640), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048805}, 0x4004080) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), r2) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x805) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000008c0)={'batadv_slave_1\x00'}) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_WAIT_SYNC(r9, 0x40089416, &(0x7f0000000a00)=r7) 12:33:12 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x5c, 0x0, 0x628, 0x70bd2b, 0x25dfdbfd, {}, [@GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3c}}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x840) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:33:12 executing program 0: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x4, 0x2, 0x7}, 0x4}}, 0x18) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x1, 0x4, 0x2}, 0x7fffffff}}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x20000815) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x40080) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000300)={0xb, 0x77, 0x2, 0x8}, 0xb) r3 = socket(0x10, 0x1, 0x101) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000340)={"5d23b2383e7ad8d82206d63b317bdb94", 0x0, 0x0, {0x100000001, 0x100}, {0x2, 0x2}, 0x2, [0x7, 0x1ff, 0x20, 0x8000, 0xf87, 0x9, 0x8, 0x101, 0x9, 0x1, 0x6, 0x100000000, 0x7, 0x9d5, 0xffff, 0xeef]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000440)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000480)={"bafcce709c4a3744791a583033d340ea", r4, r5, {0x400, 0x4608}, {0x4, 0xffffffff}, 0xa5, [0x5b0f, 0x3, 0x4, 0x6, 0xfffffffffffff001, 0x7, 0xffffffffffffff8b, 0x6, 0x3ff, 0x7fff, 0x1, 0x1, 0x9, 0x2, 0xfff, 0xffff]}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000580)=0x800, 0x4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x12}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2}, 0x80) syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r3) sendmsg$BATADV_CMD_GET_HARDIF(r3, &(0x7f0000000800)={&(0x7f0000000740), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x1c, r2, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x80) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4c804) 12:33:12 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r2, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) 12:33:12 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) socket$nl_audit(0x10, 0x3, 0x9) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:33:12 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:33:12 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r1 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r1, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f0000000100)=""/180) shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) 12:33:12 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) socketpair(0x29, 0x3, 0x8, &(0x7f0000001800)) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) 12:33:12 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x2c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x1) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:33:12 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000600)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/90, 0x5a, 0x1, &(0x7f00000005c0)=""/31, 0x1f}, &(0x7f0000000640)=0x40) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:33:12 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROM_LAST_WRITTEN(r2, 0x5395, &(0x7f00000017c0)) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) 12:33:12 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:33:12 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r1 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r1, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f0000000100)=""/180) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) 12:33:12 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) clock_gettime(0x0, &(0x7f0000000500)) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:33:12 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r2, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) clock_getres(0x6, &(0x7f00000002c0)) syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) 12:33:12 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) openat$cdrom(0xffffffffffffff9c, &(0x7f0000001780), 0x301001, 0x0) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) [ 187.862976] INFO: task rcu_gp:3 blocked for more than 143 seconds. [ 187.863172] Bluetooth: hci0: command 0x0406 tx timeout [ 187.864025] Not tainted 6.0.0-rc7-next-20220930 #1 [ 187.865033] Bluetooth: hci3: command 0x0406 tx timeout [ 187.865857] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 187.865870] task:rcu_gp state:I [ 187.866770] Bluetooth: hci4: command 0x0406 tx timeout [ 187.868464] stack:30328 pid:3 ppid:2 flags:0x00004000 [ 187.869710] Bluetooth: hci1: command 0x0406 tx timeout [ 187.870359] Call Trace: [ 187.871419] Bluetooth: hci2: command 0x0406 tx timeout [ 187.872083] [ 187.872103] __schedule+0x893/0x2470 [ 187.872602] Bluetooth: hci7: command 0x0406 tx timeout [ 187.873296] ? io_schedule_timeout+0x150/0x150 [ 187.873649] Bluetooth: hci6: command 0x0406 tx timeout [ 187.874137] ? do_raw_spin_lock+0x121/0x260 [ 187.876986] ? rwlock_bug.part.0+0x90/0x90 [ 187.877603] schedule+0xda/0x1b0 [ 187.878140] rescuer_thread+0x851/0xdb0 [ 187.878738] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.879490] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.880240] ? lockdep_hardirqs_on+0x79/0x100 [ 187.880914] ? worker_thread+0x1260/0x1260 [ 187.881527] kthread+0x2ed/0x3a0 [ 187.882049] ? kthread_complete_and_exit+0x40/0x40 [ 187.882752] ret_from_fork+0x22/0x30 [ 187.883348] [ 187.883685] INFO: task rcu_par_gp:4 blocked for more than 143 seconds. [ 187.884639] Not tainted 6.0.0-rc7-next-20220930 #1 [ 187.885419] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 187.886506] task:rcu_par_gp state:I stack:30944 pid:4 ppid:2 flags:0x00004000 [ 187.887696] Call Trace: [ 187.888096] [ 187.888456] __schedule+0x893/0x2470 [ 187.889046] ? io_schedule_timeout+0x150/0x150 [ 187.889707] ? do_raw_spin_lock+0x121/0x260 [ 187.890368] ? rwlock_bug.part.0+0x90/0x90 [ 187.891020] schedule+0xda/0x1b0 [ 187.891519] rescuer_thread+0x851/0xdb0 [ 187.892134] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.892915] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.893639] ? lockdep_hardirqs_on+0x79/0x100 [ 187.894349] ? worker_thread+0x1260/0x1260 [ 187.895653] kthread+0x2ed/0x3a0 [ 187.896193] ? kthread_complete_and_exit+0x40/0x40 [ 187.896945] ret_from_fork+0x22/0x30 [ 187.897516] [ 187.897892] INFO: task slub_flushwq:5 blocked for more than 143 seconds. [ 187.898890] Not tainted 6.0.0-rc7-next-20220930 #1 [ 187.899653] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 187.900787] task:slub_flushwq state:I stack:30944 pid:5 ppid:2 flags:0x00004000 [ 187.902059] Call Trace: [ 187.902433] [ 187.902775] __schedule+0x893/0x2470 [ 187.903387] ? io_schedule_timeout+0x150/0x150 [ 187.904106] ? do_raw_spin_lock+0x121/0x260 [ 187.904763] ? rwlock_bug.part.0+0x90/0x90 [ 187.905431] schedule+0xda/0x1b0 [ 187.905974] rescuer_thread+0x851/0xdb0 [ 187.906569] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.907360] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.908124] ? lockdep_hardirqs_on+0x79/0x100 [ 187.908871] ? worker_thread+0x1260/0x1260 [ 187.909505] kthread+0x2ed/0x3a0 [ 187.910050] ? kthread_complete_and_exit+0x40/0x40 [ 187.910774] ret_from_fork+0x22/0x30 [ 187.911412] [ 187.911754] INFO: task netns:6 blocked for more than 143 seconds. [ 187.912696] Not tainted 6.0.0-rc7-next-20220930 #1 [ 187.913490] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 187.914634] task:netns state:I stack:30944 pid:6 ppid:2 flags:0x00004000 [ 187.915863] Call Trace: [ 187.916267] [ 187.916620] __schedule+0x893/0x2470 [ 187.917245] ? io_schedule_timeout+0x150/0x150 [ 187.917966] ? do_raw_spin_lock+0x121/0x260 [ 187.918616] ? rwlock_bug.part.0+0x90/0x90 [ 187.919300] schedule+0xda/0x1b0 [ 187.919862] rescuer_thread+0x851/0xdb0 [ 187.920481] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.921269] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.922068] ? lockdep_hardirqs_on+0x79/0x100 [ 187.922732] ? worker_thread+0x1260/0x1260 [ 187.923413] kthread+0x2ed/0x3a0 [ 187.923982] ? kthread_complete_and_exit+0x40/0x40 [ 187.924723] ret_from_fork+0x22/0x30 [ 187.925364] [ 187.925726] INFO: task kworker/0:0:7 blocked for more than 143 seconds. [ 187.926727] Not tainted 6.0.0-rc7-next-20220930 #1 [ 187.927544] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 187.928718] task:kworker/0:0 state:I stack:29592 pid:7 ppid:2 flags:0x00004000 [ 187.929977] Workqueue: 0x0 (rcu_gp) [ 187.930559] Call Trace: [ 187.930993] [ 187.931348] __schedule+0x893/0x2470 [ 187.931969] ? io_schedule_timeout+0x150/0x150 [ 187.932689] schedule+0xda/0x1b0 [ 187.933263] worker_thread+0x15f/0x1260 [ 187.933935] ? process_one_work+0x16a0/0x16a0 [ 187.934629] kthread+0x2ed/0x3a0 [ 187.935193] ? kthread_complete_and_exit+0x40/0x40 [ 187.935982] ret_from_fork+0x22/0x30 [ 187.936626] [ 187.937027] INFO: task kworker/0:0H:8 blocked for more than 143 seconds. [ 187.938044] Not tainted 6.0.0-rc7-next-20220930 #1 [ 187.938863] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 187.940018] task:kworker/0:0H state:I stack:29464 pid:8 ppid:2 flags:0x00004000 [ 187.941187] Workqueue: 0x0 (kblockd) [ 187.941709] Call Trace: [ 187.942084] [ 187.942399] __schedule+0x893/0x2470 [ 187.942942] ? io_schedule_timeout+0x150/0x150 [ 187.943560] schedule+0xda/0x1b0 [ 187.944052] worker_thread+0x15f/0x1260 [ 187.944619] ? process_one_work+0x16a0/0x16a0 [ 187.945252] kthread+0x2ed/0x3a0 [ 187.945710] ? kthread_complete_and_exit+0x40/0x40 [ 187.946391] ret_from_fork+0x22/0x30 [ 187.946948] [ 187.947258] INFO: task mm_percpu_wq:10 blocked for more than 143 seconds. [ 187.948141] Not tainted 6.0.0-rc7-next-20220930 #1 [ 187.948869] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 187.949873] task:mm_percpu_wq state:I stack:30944 pid:10 ppid:2 flags:0x00004000 [ 187.950964] Call Trace: [ 187.951306] [ 187.951615] __schedule+0x893/0x2470 [ 187.952181] ? io_schedule_timeout+0x150/0x150 [ 187.952780] ? do_raw_spin_lock+0x121/0x260 [ 187.953393] ? rwlock_bug.part.0+0x90/0x90 [ 187.954001] schedule+0xda/0x1b0 [ 187.954458] rescuer_thread+0x851/0xdb0 [ 187.955023] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.955677] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.956372] ? lockdep_hardirqs_on+0x79/0x100 [ 187.956998] ? worker_thread+0x1260/0x1260 [ 187.957555] kthread+0x2ed/0x3a0 [ 187.958039] ? kthread_complete_and_exit+0x40/0x40 [ 187.958677] ret_from_fork+0x22/0x30 [ 187.959227] [ 187.959541] INFO: task rcu_tasks_kthre:11 blocked for more than 143 seconds. [ 187.960472] Not tainted 6.0.0-rc7-next-20220930 #1 [ 187.961199] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 187.962233] task:rcu_tasks_kthre state:I stack:29272 pid:11 ppid:2 flags:0x00004000 [ 187.963308] Call Trace: [ 187.963649] [ 187.963988] __schedule+0x893/0x2470 [ 187.964513] ? io_schedule_timeout+0x150/0x150 [ 187.965144] ? mark_held_locks+0x9e/0xe0 [ 187.965677] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 187.966355] schedule+0xda/0x1b0 [ 187.966836] rcu_tasks_one_gp+0x3db/0xc10 [ 187.967401] rcu_tasks_kthread+0x80/0xa0 [ 187.967955] ? rcu_tasks_postscan+0x10/0x10 [ 187.968521] kthread+0x2ed/0x3a0 [ 187.968999] ? kthread_complete_and_exit+0x40/0x40 [ 187.969625] ret_from_fork+0x22/0x30 [ 187.970161] [ 188.015858] INFO: task kworker/1:0H:21 blocked for more than 143 seconds. [ 188.016721] Not tainted 6.0.0-rc7-next-20220930 #1 [ 188.017417] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 188.018385] task:kworker/1:0H state:I stack:29760 pid:21 ppid:2 flags:0x00004000 [ 188.019444] Workqueue: 0x0 (events_highpri) [ 188.020047] Call Trace: [ 188.020384] [ 188.020674] __schedule+0x893/0x2470 [ 188.021195] ? io_schedule_timeout+0x150/0x150 [ 188.021788] schedule+0xda/0x1b0 [ 188.022265] worker_thread+0x15f/0x1260 [ 188.022785] ? process_one_work+0x16a0/0x16a0 [ 188.023394] kthread+0x2ed/0x3a0 [ 188.023868] ? kthread_complete_and_exit+0x40/0x40 [ 188.024492] ret_from_fork+0x22/0x30 [ 188.025011] [ 188.025320] INFO: task inet_frag_wq:23 blocked for more than 143 seconds. [ 188.026162] Not tainted 6.0.0-rc7-next-20220930 #1 [ 188.026847] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 188.027775] task:inet_frag_wq state:I stack:30704 pid:23 ppid:2 flags:0x00004000 [ 188.028864] Call Trace: [ 188.029185] [ 188.029475] __schedule+0x893/0x2470 [ 188.029999] ? io_schedule_timeout+0x150/0x150 [ 188.030576] ? do_raw_spin_lock+0x121/0x260 [ 188.031158] ? rwlock_bug.part.0+0x90/0x90 [ 188.031698] schedule+0xda/0x1b0 [ 188.032183] rescuer_thread+0x851/0xdb0 [ 188.032697] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 188.033354] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 188.034013] ? lockdep_hardirqs_on+0x79/0x100 [ 188.034584] ? worker_thread+0x1260/0x1260 [ 188.035157] kthread+0x2ed/0x3a0 [ 188.035594] ? kthread_complete_and_exit+0x40/0x40 [ 188.036266] ret_from_fork+0x22/0x30 [ 188.036760] [ 188.037143] [ 188.037143] Showing all locks held in the system: [ 188.037927] 1 lock held by rcu_tasks_kthre/11: [ 188.038481] #0: ffffffff85406850 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc10 [ 188.039698] 1 lock held by khungtaskd/25: [ 188.040245] #0: ffffffff85407320 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 [ 188.041399] 1 lock held by systemd-journal/111: [ 188.042004] 1 lock held by in:imklog/189: [ 188.042504] #0: ffff88801024fc68 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe7/0x100 [ 188.043578] 2 locks held by syz-executor/4314: [ 188.044190] [ 188.044415] ============================================= [ 188.044415] 12:33:25 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) r3 = shmget$private(0x0, 0x1000, 0x8, &(0x7f0000ffe000/0x1000)=nil) shmat(r3, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:33:25 executing program 3: ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0xfffffffffffffff8) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0xfffffffffffffc01, 0x10000) ioctl$CDROMSTART(r0, 0x5308) ioctl$CDROMREADRAW(r0, 0x5314, &(0x7f0000000040)={0x20, 0x7, 0x4, 0x47, 0x30, 0x20}) ioctl$CDROMRESET(r0, 0x5312) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000b80)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfd2a}]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x4c000) ioctl$CDROMEJECT_SW(r0, 0x530f, 0x1) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) accept4(r0, &(0x7f0000000bc0)=@nl=@proc, &(0x7f0000000c40)=0x80, 0x800) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x8) 12:33:25 executing program 6: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ieee802154, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) clock_getres(0x1, &(0x7f0000000180)) socketpair(0x8, 0xa, 0x4, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000200)=0x14, 0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000240), 0x4, 0x80000) ioctl$CDROMPLAYMSF(r2, 0x5303, &(0x7f0000000280)={0x8, 0x44, 0x20, 0x2, 0x1, 0x5}) syz_open_dev$usbmon(&(0x7f0000000380), 0x1, 0x24480) 12:33:25 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r1 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r1, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) r2 = shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) 12:33:25 executing program 4: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@qipcrtr, &(0x7f00000000c0)=0x80, 0x80000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xbc, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'tunl0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bridge\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @loopback}, @NLBL_UNLABEL_A_SECCTX={0x2d, 0x7, 'system_u:object_r:netcontrol_device_t:s0\x00'}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x20008024) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r1, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_bond\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4008081) ioctl$DVD_AUTH(0xffffffffffffffff, 0x5390, &(0x7f0000000440)=@lstk={0x7, 0x3, "f04052356d", 0x0, 0x0, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000480)=0x1, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000004c0)="6ebafffa393c3b9dd22e135e8988b5b7", 0x10) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r2, &(0x7f0000000b40)={0xfffffffffffffff7, 0x20, 0x100, 0x20, 0x200}, 0x48) 12:33:25 executing program 7: r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfc6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xec}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local}]}, 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x24008841) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x600a3506b5b96c57}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x80000001}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x590}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x55}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x200c0044) syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), 0xffffffffffffffff) socketpair(0xf, 0xa, 0xff, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r2, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r4, 0x300, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040810}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000500), 0x259, 0x22600) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000540)={"0022d576d5cdfac9a96440af070c389b", 0x0, 0x0, {0x1, 0x3}, {0x0, 0x2}, 0xfff, [0x4, 0x9, 0x7, 0x0, 0x8, 0x3, 0x5, 0x5, 0x8, 0xfe5, 0x4, 0x3ff, 0x7, 0x6, 0x1, 0xfff]}) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000700)={&(0x7f0000000640), 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048805}, 0x4004080) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), r2) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x4c, r8, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef6}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x805) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000008c0)={'batadv_slave_1\x00'}) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000a00)=r7) 12:33:25 executing program 0: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xd, 0x2, {{0x4, 0x2, 0x7}, 0x4}}, 0x18) r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0xd, 0x1, {{0x1, 0x4, 0x2}, 0x7fffffff}}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r0, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x20000815) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x40080) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000300)={0xb, 0x77, 0x2, 0x8}, 0xb) r3 = socket(0x10, 0x1, 0x101) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000340)={"5d23b2383e7ad8d82206d63b317bdb94", 0x0, 0x0, {0x100000001, 0x100}, {0x2, 0x2}, 0x2, [0x7, 0x1ff, 0x20, 0x8000, 0xf87, 0x9, 0x8, 0x101, 0x9, 0x1, 0x6, 0x100000000, 0x7, 0x9d5, 0xffff, 0xeef]}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000440)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000480)={"bafcce709c4a3744791a583033d340ea", r4, r5, {0x400, 0x4608}, {0x4, 0xffffffff}, 0xa5, [0x5b0f, 0x3, 0x4, 0x6, 0xfffffffffffff001, 0x7, 0xffffffffffffff8b, 0x6, 0x3ff, 0x7fff, 0x1, 0x1, 0x9, 0x2, 0xfff, 0xffff]}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000580)=0x800, 0x4) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r2, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x12}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2}, 0x80) syz_genetlink_get_family_id$batadv(&(0x7f0000000700), r3) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4c804) 12:33:25 executing program 2: write$tcp_mem(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffff7, 0x20, 0x1, 0x20, 0x100}, 0x48) r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x10db00, 0x0) ioctl$CDROMREADCOOKED(r0, 0x5315, &(0x7f00000000c0)) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000b40), 0x400000, 0x0) ioctl$CDROMREADRAW(r1, 0x5314, &(0x7f0000000b80)={0x7, 0x8, 0x0, 0x9, 0x1, 0x9d}) ioctl$CDROM_MEDIA_CHANGED(r1, 0x5325, 0x7) ioctl$CDROM_NEXT_WRITABLE(r1, 0x5394, &(0x7f0000001600)) ioctl$CDROM_GET_MCN(r1, 0x5311, &(0x7f0000001640)) ioctl$CDROMREADAUDIO(r0, 0x530e, &(0x7f00000016c0)={@msf={0x0, 0x4e, 0x3e}, 0x3, 0x12, &(0x7f0000001680)=""/18}) ioctl$CDROMVOLCTRL(r0, 0x530a, &(0x7f0000001700)={0x3f, 0x20, 0x4, 0xd1}) ioctl$CDROMCLOSETRAY(r0, 0x5319) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000001740)=0x2, 0x4) ioctl$CDROMVOLREAD(r0, 0x5313, &(0x7f0000001a80)) 12:33:26 executing program 1: r0 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ff9000/0x4000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/151) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f00000000c0)=""/33) shmctl$SHM_UNLOCK(r0, 0xc) shmctl$SHM_STAT(r0, 0xd, &(0x7f0000000100)=""/151) shmctl$IPC_STAT(r0, 0x2, &(0x7f00000001c0)=""/67) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/93) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) r2 = shmget(0x1, 0x3000, 0x40, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_LOCK(r2, 0xb) shmctl$IPC_RMID(0x0, 0x0) shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x1000) 12:33:26 executing program 5: r0 = shmget$private(0x0, 0x4000, 0x200, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/132) shmget$private(0x0, 0x2000, 0x54000000, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) r1 = shmget$private(0x0, 0x3000, 0x1, &(0x7f0000ffc000/0x3000)=nil) shmat(r1, &(0x7f0000ffa000/0x3000)=nil, 0x5000) shmctl$SHM_STAT_ANY(r1, 0xf, &(0x7f00000000c0)=""/48) shmctl$SHM_LOCK(r0, 0xb) shmget(0x1, 0x1000, 0x400, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000400)=""/245) [ 196.054985] Bluetooth: hci5: command 0x0406 tx timeout VM DIAGNOSIS: 12:33:22 Registers: info registers vcpu 0 RAX=000000000000006d RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff823bb0f1 RDI=ffffffff8765a9a0 RBP=ffffffff8765a960 RSP=ffff88800902f988 R8 =0000000000000001 R9 =000000000000000a R10=000000000000006d R11=0000000000000001 R12=000000000000006d R13=ffffffff8765a960 R14=0000000000000010 R15=ffffffff823bb0e0 RIP=ffffffff823bb149 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffcc2c51c98 CR3=0000000024e6e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 00000000ff000000 0000000000000000 YMM01=0000000000000000 0000000000000000 636f6c63006b6165 6c6d656d6b2f6775 YMM02=0000000000000000 0000000000000000 0000000000ffffff ff00000000000000 YMM03=0000000000000000 0000000000000000 0000ff0000000000 0000000000000000 YMM04=0000000000000000 0000000000000000 ffffffffffffffff ffff000000000000 YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=ffffffff823bb06c RDI=ffffffff8765a9a0 RBP=ffffffff8765a960 RSP=ffff888035f376d0 R8 =0000000000000004 R9 =0000000000000010 R10=000000000000000d R11=0000000000000001 R12=0000000000002710 R13=0000000000000060 R14=fffffbfff0ecb584 R15=dffffc0000000000 RIP=ffffffff823bb0c1 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000561c7b1e4648 CR3=000000001038a000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM02=0000000000000000 0000000000000000 0000000000000000 4154831000000000 YMM03=0000000000000000 0000000000000000 0000ff0000000000 0000000000000000 YMM04=0000000000000000 0000000000000000 732f6c61636f6c2f 7273752f3d485441 YMM05=0000000000000000 0000000000000000 622f6c61636f6c2f 7273752f3a6e6962 YMM06=0000000000000000 0000000000000000 73752f3a6e696273 2f7273752f3a6e69 YMM07=0000000000000000 0000000000000000 6e69622f3a6e6962 732f3a6e69622f72 YMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000