syzkaller login: [ 40.249688] sshd (244) used greatest stack depth: 24776 bytes left Warning: Permanently added '[localhost]:45716' (ECDSA) to the list of known hosts. 2022/10/04 13:43:22 fuzzer started 2022/10/04 13:43:22 dialing manager at localhost:35095 [ 42.618918] cgroup: Unknown subsys name 'net' [ 42.712907] cgroup: Unknown subsys name 'rlimit' 2022/10/04 13:43:36 syscalls: 206 2022/10/04 13:43:36 code coverage: enabled 2022/10/04 13:43:36 comparison tracing: enabled 2022/10/04 13:43:36 extra coverage: enabled 2022/10/04 13:43:36 setuid sandbox: enabled 2022/10/04 13:43:36 namespace sandbox: enabled 2022/10/04 13:43:36 Android sandbox: enabled 2022/10/04 13:43:36 fault injection: enabled 2022/10/04 13:43:36 leak checking: enabled 2022/10/04 13:43:36 net packet injection: enabled 2022/10/04 13:43:36 net device setup: enabled 2022/10/04 13:43:36 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/10/04 13:43:36 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/10/04 13:43:36 USB emulation: enabled 2022/10/04 13:43:36 hci packet injection: enabled 2022/10/04 13:43:36 wifi device emulation: failed to parse kernel version (6.0.0-rc7-next-20220930) 2022/10/04 13:43:36 802.15.4 emulation: enabled 2022/10/04 13:43:36 fetching corpus: 0, signal 0/0 (executing program) 2022/10/04 13:43:38 starting 8 fuzzer processes 13:43:38 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000600), r4) 13:43:38 executing program 1: io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) r0 = io_uring_setup(0x5c84, &(0x7f0000000000)={0x0, 0xdfb4, 0x0, 0x2, 0x29c}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000000c0)=[r0], 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x80202, 0x0) syz_io_uring_setup(0x3781, &(0x7f0000000140)={0x0, 0xdb69, 0x11, 0x0, 0xae, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x8, &(0x7f0000000240)=[{0x7, 0x7f, 0x1, 0x6}, {0x2, 0x85, 0x1, 0x3f}, {0x1, 0x2, 0x1, 0x5}, {0xa441, 0x3f, 0x7, 0x1}, {0x20, 0x6, 0x1, 0x3}, {0x800, 0xba, 0x4, 0x3}, {0x1f, 0x0, 0x7f, 0x41}, {0x711, 0x2, 0x9, 0x4}]}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x16) openat$full(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x6, 0x2}}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r5, 0x20, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/128, 0x80, 0x0, &(0x7f0000000500)=""/57, 0x39}, &(0x7f0000000580)=0x40) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, &(0x7f00000005c0), 0x9, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x4, &(0x7f0000000600)=[{0x101, 0x1, 0x7, 0x10001}, {0x1, 0x59, 0x80, 0x80}, {0x6, 0x0, 0x7f, 0xcb7f}, {0x7, 0x3, 0x3, 0x20}]}) syz_io_uring_setup(0x3386, &(0x7f0000000680)={0x0, 0xe77f, 0x4, 0x3, 0x2a2, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000700), &(0x7f0000000740)) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000780)={{0x1, 0x1, 0x18, r1, {0x3, 0x3}}, './file0\x00'}) io_uring_register$IORING_UNREGISTER_FILES(r6, 0x3, 0x0, 0x0) 13:43:38 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) r5 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmat(r5, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r6 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil) shmat(r6, &(0x7f0000ffd000/0x1000)=nil, 0x2000) r7 = request_key(&(0x7f00000005c0)='trusted\x00', &(0x7f0000000600)={'syz', 0x3}, &(0x7f0000000640)='/proc/crypto\x00', r4) keyctl$get_persistent(0x16, 0xee01, r7) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000006c0)=r2, 0x1) 13:43:38 executing program 3: sigaltstack(&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x20010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)="d5b3cd9986d3baa87b4ca2633c7d00067013dd5622b29cfaba7a84a7096557b60f9367bb90c4db98a3e862b9e3165860ffcdb36988ab226833e87dfaf8acd8b3a184d7deceaa0a0ba73214134e9057fef63dd8dca9e5c4bb94dcdfea9ad8be0f9e818a716871f5baa8abae5dd1a42103adb790ccc120ff359e495c12991d07ee0bf14e1b5e38bdaa4ac3e47e5bc8860f08f3bc6e2a4f10bba5285f3987663113fed1dbb36cb33fc9170a25d453373a912437efbcef63e4e43b77db00248a4d6896ce3fbd1eebdbf5d5f8214d94ef8020dd", 0xd1, 0x40800}, 0x4b) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3, 0x100}}, './file0\x00'}) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f00000001c0)={{0x0, 0x641a, 0x1, 0x5, 0x4, 0x0, 0x56, 0x9, 0x1, 0x7, 0x9000000, 0x7fffffff, 0x1ff, 0x5, 0x8}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000001200), &(0x7f0000001240), 0x2, 0x1) write$cgroup_pressure(r1, &(0x7f0000001280)={'some', 0x20, 0x2}, 0x2f) fcntl$setsig(r1, 0xa, 0x5) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f00000012c0), 0xc, &(0x7f0000001380)={&(0x7f0000001300)={0x50, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x881}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x80000000}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x24040090}, 0x4000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000001400), 0x8001, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x40010, r4, 0x10000000) clock_gettime(0x0, &(0x7f0000001440)={0x0, 0x0}) nanosleep(&(0x7f0000001480)={r5, r6+60000000}, &(0x7f00000014c0)) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r4, 0xc0189376, &(0x7f0000001500)={{0x1, 0x1, 0x18, r7, {0x40}}, './file0\x00'}) fsetxattr$security_ima(r2, &(0x7f0000001540), &(0x7f0000001580)=@v1={0x2, "38a37018d70eb909e432ed3a"}, 0xd, 0x3) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f00000015c0)) fcntl$setsig(0xffffffffffffffff, 0xa, 0x26) 13:43:38 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x202382, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000480)=[r3, r5, r6, r2], 0x4) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x40010, r2, 0x8000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000500)) [ 57.917607] audit: type=1400 audit(1664891018.281:6): avc: denied { execmem } for pid=285 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 13:43:38 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write$binfmt_script(r4, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '!'}, {}, {0x20, '\x00'}, {0x20, '/dev/nvram\x00'}, {0x20, ')\\+'}, {0x20, '\x00'}], 0xa, "988400f5490c5d555c1af73d5afbe95ddf48ba197d6cfb8699efa20f507a9025bcaea778f6954e98002ab42ac0255d565a4ba6019a95b8d3d0515efd39e88fa2ad4ce882aa13e298564e09602e548a5ff9ea50413a14689fd5955786509c26cfb7cb98ece1e074c0ffa18bde6559a83a5903efabf9e3164fe37cc5e73e19013aca92ac05c1e2a70a1fb60aacf8554942c9a6599dc27b4866d3081d8d2da53b91c05f99cb9411e2641e93408c8a0e8c72dd5cd83aa16f192ee0198c137fe3554400ba0cdf1c9be8099628bbe1d88ecb69c0a430974ae30237cc462324db75808dbdfb32"}, 0x105) r6 = fork() ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000700)={r6, 0x0, 0x400}) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000780)={r6}) 13:43:38 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) ioctl$PIO_UNIMAP(r7, 0x4b67, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x800, 0x4}]}) ioctl$TIOCGETD(r7, 0x5424, &(0x7f0000000700)) socket$nl_generic(0x10, 0x3, 0x10) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000780)={0x6, &(0x7f0000000740)=[{0xfff, 0x3f, 0x5, 0x7}, {0x4, 0x20, 0x80, 0x6}, {0x7, 0x7, 0x9, 0x1f}, {0x6, 0x3, 0x2, 0x2}, {0x4, 0x6b, 0x3, 0xaf38}, {0xfffe, 0x7f, 0xf9, 0x7fff}]}) fsetxattr$trusted_overlay_origin(r8, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000008c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xc00}}, './file0\x00'}) 13:43:38 executing program 7: r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000000)=[0xffffffffffffffff, 0xffffffffffffffff, r0], 0x3) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000040)) ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000240)) ioctl$KDSKBLED(r0, 0x4b65, 0x7a8) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280), 0x62222, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE(r1, 0x5000940e, &(0x7f00000002c0)={{r0}, "951fe09a7b1d9a9c25f8acf3976098dae180455b3912fb01ce53168d325c37bf0d713e22621f01b29e2445d317a7bf6c19c1ce72c7e542798e693c969cd9a42cab71f98e475f2b121d5645820648945e7691c224bf4c03b868f6a9b7dbbf26d4d09c972752b07c5ad110776b4b01a0040ee0494c771861e10843bc961fc0ccb03a7f7aa12d4dd454f3ef1083ae0c76fd4c974a808ef99b768fb0b79f15d1124a5db6f75e9ba17d8cb8e65b46cb911f4cfc99d6bcd382863732feede10732bb1d1ce7d7a46df9b3224cc25f7f6336ef567365d97e458b37cd87c1556e6978d678b4c2950017547d5d4b753d94356408d1fa9d016782cf858a6b13466a2a01a363b759a8beef9bb296e4bbe840e4e56807005aa3fe33cb7c2d3d9db12dddc992a32a6fc0cccb1f266386bc32a0ea35394b1464469d2e2d4e5c41884e32e32ae2b7ebd15f53b129b2b026670d971a36eda2323e60fe68266d587bc37ae10b4e105e6ee3f2bba5b1f9e2a5cabdb1daf1f4e696ae0bb9b8709e018c4dbf4b2d843a1acbd9a4b22b740cac8e10eaa492ede2241b84da293ec964b48b8254a3a9a8a3f90c043e39ad83597d29e47e3b57d59bd25567f3c041448be938067eb31556ea37512fe359ab681dc65a5934e5db055e3eb8ee551a0fc1cfe05cc5e443919b277097ea4ab7478f4e21e3b527464890800da63bbf13e23f8b08694a001ad9f31ca01dd14637249c2ef0c32495d92202d270f0c053b02b971daeeff9bc134891cadc30469d0b7a0749d886d9ed3259248b6e252cd477c198997bdd6f7da6c0f6a323d8a3b73c6fa93b4b60fe49a9996f21bec3b7d5afa2d5261743f027fca9263e83c112d8db1c02c2925128b71242a329f1dfb33e2bcea0b3c836bc58f00d12b10258d5d16ed9b9233d26d121d6f3ecf054db994b6b976dee9a15caa6867e36198e95141322886adb810ad1045beb3d061a8acf29fd86b03cc273d29b5afb7eaa6c6eed8f4570bd9f5cf9af71c9b4b65af8179b7c5a720c49260a16ef53a5a7b698bd32908267e416c3cf6c48934f08997308e26ad9b0e206ddd29b543c185adadec49e9a5bb55fcb44efc491ccabf9401939f48e1ab9aad460eeb0069d0cdd1fef58c864c1a9deb96a704f79204a38e73d4109c5e396b2d4d09adb4756ab309c4031ba2cebcb3ff5e5f01b04b30bc9c89ec1d90a3a0cf533a65ea66973ab3cd3d9186b75c54a546c0ad22b300ce1112d3fde65110ca6982f002f035595dcd54753609f80094af5033a84685c4225465ec5669e73ff9b271664c575030500d5a3dc253aecfd95491e15022362c1bd6cd94bccf6137b48f5c2564585b20fa9fb9c74fd7d8bceaf8093e18d3184764bf065401b7aa747b50fbf2baab9fb9e4defd025d2bc4da8cf7eb8d836f4ba814088ccd11d975bce4ccb98a2452310f13bf301a677461b185c0a5f2fc151d7ac12b42d3045b75edb9f4049034a6d77a722963091491d4d3982d7702eba2296e1a26a1cd7ddade2748379be162f55920bbc72a97e278cc00c72e5d4b885c1228fe62b3e437cf0ce0f2a57475e2ff135dda6286ae56f07102fd73ae5f6cbf47f8b767dadc3996b1ba05d67025b048f3f799dacee5d867c708c13ef71b6d91d35afb968436d80341641a1e470e1aa020f1d39c86a36681edae2a9d67376630e1e9c7522946693fbe98ed2bb6161052a1f0be7fbef9b5da5d2307e0a88147ffc97f5b3d3ec7b283ba8596e6349ca9ee5219188fcf3bd15ece88000d84ce5fdcc8fef8a3e43abbe1e27e415bd19cea2dd7a39b8591662e630bae339274da2734a7efc2f410d8c75a043a2c899ccd2025dabd22bbc219c1dd4fccf983f9c42b3bc362c5d7d8f482dc677c046ccfd7b45a9763b895802d90a6d304a58993c8e8377e9e21455e5b160926671ee79c2a753dafe3aeac10a02e1164b836ff69c3623c0bde1d7e641a3d9fe22cad9ac9ad4a7d1918b69966c058bfe2dc47f17d173ab7eaf8ab285e930664b5f073ee8c00c922173e0df56a87527ad20e28197ca61fcaeb61ae701662b107359e6d8dc7dd11ccc82c9d948fbacd109c134e33ec6348d3536011d153ace006fb178c9ae0bb717d49274cafb264d1ba845f34f729dcd32fa2846d8e7c2595b88ec84a8163c125a00d190c52e1a69e6ab1bbc2e33d21cf1059f37a591a5e258f9ab02d9fb7e9227265a28f7ccb50a09006ef3225c7a5a0386d4f7c390fd3c17c41cb2de586b46fbaf5a841b2da361047a6e473efea4346f002ab7c3552a1f71653c7c16f03b81b2936924d515fb5df77caac37b4da884f82b8611ef18f14fb940f1ebc3b8f9e6a49b67e07707788bc12738a5a14adb55f73eb334f5856d4ab36e72b03e3e2d00c93e896cfc5b0411bd2758d2ed13a045ceb4b15a0b1d992565f6bd4a3ac8f5f952328c5d4351e7d63321a23020bed348c69b57f947870c9518edaa1e9be69acbc3cdafd4ad0c72c14a71fbc4683a64e5d54c844bdc0e68a78232eae7d8c05347d04218610f421e2a78366b955b1b8da021799d47b35a94ae65d039ee788f95d74611108733952c03882a292a0d6110fd8fbf1b0dfbe448dd46b25add566b26183f25185df4b64d132900451d8a2b3e68128b9ee5c35fd962802c5f830458cd4712e939e311dab710502b4975a46393afcb318f9966e3a271fe3b1f735c4820aae2a3feb1ce10b40f24b60f8a2b60fbada2dac7c45d0650a65138e77e719ec520fe6e7a3c8df85f78b8e3b8ca497acdb078b2209ec1e20d65a42498474bafbaf41fccef9c1c16207a3bb1792c41d6ff19ba1013634485f5c1d555ec7bdcbb927b1a5827c08fb38d989345b22a356d5a46497357625a973cd90da9793aad2846f606482d64a184838f55a2146b7ea22150f6875d0063766e2e9dd11d4371d8eda96ca343778fae0666b726041d2c3ec3230d7d122e9c6e632d7239a3f3d8181927d22133e608223263868ba5a94ff4395913676cf044b610a99c1584ed34c73d9969e41c6413dec9c00d9be98db7d775bf4cb121de74b6bc100afc2d237122f5bad5255a87651ceeac716d2e42cfd7a22431b69bc142cb4dcbd44168eee396a6f75cfd5fe3f200685420bf80267d16d3342029253e91b718d0ddf55fcebb85fc8044e2d7f6b3bd4004e24ee81494f334b21fa6dedeb40e66d9bb2d9d3de53abda3b421f08a6abd10b6e80dfa8dc6b7108ab9cd8c1c45fcfd400605f5f068636e2384d3df54be5fa9fa01657b664d4e6e14abb8a339823ba9e98612ed4f34749b748282e4a0524a4da1503f013d024521b345c39c8aff9b441f546244a003c70987f0bd52c03a0f2fad9e6dfe0c2d3dfeee74576d0ff571cab49571727d69a33b0a9b2cc87b3362e088df07aae008c1675f12062bcfbea78c2e914689611d4daebbd05d395474a1b9453a34263b8481208579f133566cadfa345fcc4a85aef5f0e24949138f788fde76cc1a5ef31a21feb982fbe22242cb62e8817f43847f4a5de51e590c361849c868fc276a04324e34c8b1d47c3dda562e3e4001c1455cb59e16561e58acef691e8a8fcbb8c89de1e85f7e7ce64d91bb6362efd08b6c2c8bd80ff833091a15a474b623bfd03f6b3514e6d6a471a137cbc54d1e99acc61608438de19a54c04fa2b6e59bff3f2e25348d558496e52826470c22f63cbbdef994c13b0b6c842b3e8c34d765068c7a0d5d0d53fb481fac5777e93c5617a7ab3574330437a1bb0e9479001f56aaddf1208bf43292f82c2cf2a1917e5afc4b1cb8f66ad302567ebb7ec50e44549664b6a0e170bc38e28bd5c2d7cf2c7ede27fe539ea9f3a6add73c789e1180c004759a79e84f0449b53a574588397b8b500792ba58ba679e9f5ff5010c8c70846a0dfa5bf409aa97403881ecd559d2642a4adc27270809ed0c5ce159c803a0ac6f44911cffd9d0cdf1df9a773c35f3ccf8b99b5e44d8445cde5fd84efa1083216ff6088200c0f8391d719bd22d7552ab838e8bc567b658c9ad9b255f78d0a79b07ae41ba4aba6334bf7909ceb57b7112383d2568e2d84277752050e536fef52ff1ca82960a1e7a099889ca283ccc3add5bf7f5dd7b819127db9ddd0c0071eaa2d17ef5faa388dfbddbda3d493d63873143f91165bc0077b476997e773f42e1be5c3a4d61d9a9af979fe17d57c2e462a79936677daa6960798ba2c5e5f2846d997cea543b518d1d4a13bccdad4252a6f23382df3eb5f3ea3012316db9261119833630105322b7cc6eca6e1e9c8e3a1db70dcb2b470aafd907d094ac23a61a94068a65cf5e47ad82fa2162c88f53fd626cf7f4f2870de12319e081572a56b2010d2aebd4bc5dfe5b3f3e01a2a3b1e2910365f47652e0e5df5245538ae49a95727a1687c0d9f92f672d45eb757c8eb710a95d4c0bf6586111818c6b6873ed400b3cca01db06514257be5dc3b20b4898eec5bb5df70d6f1917ae12b29e6f9df2effaad9a622af2625836997cd5a9d14e90844e9894fd3d316a7a129c29df0023fe8771711f46f312850d999fbfc68362391e7a3b34e22315b51c1ccb1f098b9a4a68331444c58afd64a89837fa3dce2edb8541281fc86f56c4be06225046ae62a950cf24a26b33e785e35d3e230f4aa56c16cf52e906bef6ba23ed85ede3abd28fb31bc46c0cb7c6e8bc93a65784f2d298722d89b96d073b532fd25eda67a0d4bd67e2926edad6112bd85338c7e063d13e5214bda62c76c49cfa9f3402ae2f2166fb1160506a5c8a7c1f8bc7405f3e6cfa9cc4f2aee8e2031d738927443d7f2f637fedef690ad0282e036026e3a4a8e00c03f6665f1fdf959f351d3511ac1bccba5ebcc4e0f7ce68533420ae84cce4f09d7388395fc9e14b2c05d1bedc4d7978ea97329052deb8a06529f31b6bde5b713637c496da021f3589fa2ee985f6c578922be9fcd13e019e1e4ea5e6f45bd5c677a56028f2c0461c253f467644fbaeb8d0ad033723c3514e14a098436c8ea93693ec4ae18a5f6baa9bfb7cdcb562522c63c8501db4c3b06e8e59046adcafc80d7a28ea82411675183f735f598b4a09606c155c81c50bfa248667ec9f0c1dba47c6f0e9c2d023cdc0423e09c1f2edf27c5475822510c8e342336769bdd190e84dd874c73ca75a1a36924db338ebe779d27285029351f69565fe3fd652b7983be29c5a74e07676ecf3420f84b8503957aaed36efca22bc1e3ad5de36bfd9c38eacd01f533216c0dcadba9988aa931f62566ab3fa491359f9487871f1473b6a04892247e43d87ab40ca21f2955b8e581e67ad01389f9c2b4476f3e7bde0f5ce8fb43e4d89e00a4158184c31014455914ec5c0253fc253e4239f53bebc1b1f15493e3c1f45983560f4bbc8263cc1236cb2a8bd045e6a277d71f0b8359b3ca339c58c4add0385ffd8d8668aaa252374684a1276ad3c2f47cc14dac1d8ab5a965978e4e6ae3e7c4a3461bfe28c893ce6bb7f639895148c2d030a52a4a07c2dd13c935e9223c86c2ccfbe9d6620ec56a07c637700f43833485f2103f326f30bbcdeba12449f0fbb015832e995d09db0ba576df8497eece2ba4c8817cc96474b99b30b95fc02f395f69881bb357412386e09e5f5a8e180a39d734a59cc4660c80ad18b5cf32ea6a931f55c16bc02993685bb99670910364d4857d36ecd8218780037382a6ba46798bf7bc0e3ab111ccf8d109a4a12fa1169d8d8a9ab4c6ddf86113a82eb38495e9f8c342f4fa5257d9868988e33d66faf9777ed015ae5bc42a7a07fdde8e0819a386c46b3fbeb"}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000012c0), 0x1, 0x0) write$rfkill(r2, &(0x7f0000001300)={0x20, 0x8}, 0x8) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$binfmt_script(r3, &(0x7f0000001340)={'#! ', './file0', [{0x20, '/dev/bsg\x00'}, {0x20, '/dev/full\x00'}, {0x20, '/dev/bsg\x00'}, {0x20, '/'}, {0x20, '/dev/full\x00'}], 0xa, "4cf76a8bc9066989dda0ea767a4abe786077527f7e55c53f2628a121d4c6fc7db8508170aace749f33e83340bd05880ccb56d65839398b30600b7f2704"}, 0x74) r4 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_ACTIVATE(r4, 0x5606, 0x8) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f00000013c0)=""/4096) perf_event_open(&(0x7f00000023c0)={0x2, 0x80, 0x8, 0x58, 0x3a, 0x20, 0x0, 0x5, 0x20044, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x4, 0x4, @perf_config_ext={0x8, 0x1f}, 0x2001, 0x80000001, 0x1, 0x9, 0x5, 0x8, 0x6, 0x0, 0x2, 0x0, 0x2}, 0x0, 0xa, r1, 0x2) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000002480)={0x1, &(0x7f0000002440)=[{}]}) r5 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCL_UNBLANKSCREEN(r5, 0x541c, &(0x7f00000024c0)) openat$full(0xffffffffffffff9c, &(0x7f0000002500), 0x802, 0x0) [ 59.265224] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 59.266800] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 59.268439] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 59.270176] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 59.271213] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 59.272553] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 59.274403] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 59.275648] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 59.276707] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 59.278075] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 59.282501] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 59.284014] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 59.286936] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 59.288379] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 59.290038] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 59.291437] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 59.292549] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 59.293728] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 59.295135] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 59.296710] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 59.298064] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 59.300056] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 59.307766] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 59.309301] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 59.310480] Bluetooth: hci1: HCI_REQ-0x0c1a [ 59.331522] Bluetooth: hci3: HCI_REQ-0x0c1a [ 59.332681] Bluetooth: hci2: HCI_REQ-0x0c1a [ 59.333663] Bluetooth: hci0: HCI_REQ-0x0c1a [ 59.354243] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 59.356157] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 59.357692] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 59.359681] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 59.361481] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 59.362723] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 59.364348] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 59.365688] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 59.367057] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 59.369580] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 59.371993] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 59.373386] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 59.374655] Bluetooth: hci4: HCI_REQ-0x0c1a [ 59.380220] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 59.384065] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 59.385495] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 59.390422] Bluetooth: hci5: HCI_REQ-0x0c1a [ 59.416010] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 59.429645] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 59.440105] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 59.446126] Bluetooth: hci7: HCI_REQ-0x0c1a [ 61.331902] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 61.332250] Bluetooth: hci1: command 0x0409 tx timeout [ 61.395973] Bluetooth: hci4: command 0x0409 tx timeout [ 61.395985] Bluetooth: hci3: command 0x0409 tx timeout [ 61.396181] Bluetooth: hci0: command 0x0409 tx timeout [ 61.396774] Bluetooth: hci2: command 0x0409 tx timeout [ 61.459901] Bluetooth: hci5: command 0x0409 tx timeout [ 61.460888] Bluetooth: hci7: command 0x0409 tx timeout [ 63.380910] Bluetooth: hci1: command 0x041b tx timeout [ 63.444071] Bluetooth: hci0: command 0x041b tx timeout [ 63.444115] Bluetooth: hci4: command 0x041b tx timeout [ 63.444997] Bluetooth: hci3: command 0x041b tx timeout [ 63.445385] Bluetooth: hci2: command 0x041b tx timeout [ 63.509137] Bluetooth: hci7: command 0x041b tx timeout [ 63.509156] Bluetooth: hci5: command 0x041b tx timeout [ 65.427878] Bluetooth: hci1: command 0x040f tx timeout [ 65.491919] Bluetooth: hci3: command 0x040f tx timeout [ 65.491948] Bluetooth: hci4: command 0x040f tx timeout [ 65.492372] Bluetooth: hci0: command 0x040f tx timeout [ 65.493485] Bluetooth: hci2: command 0x040f tx timeout [ 65.555894] Bluetooth: hci5: command 0x040f tx timeout [ 65.556860] Bluetooth: hci7: command 0x040f tx timeout [ 65.939852] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 67.475906] Bluetooth: hci1: command 0x0419 tx timeout [ 67.540000] Bluetooth: hci2: command 0x0419 tx timeout [ 67.540858] Bluetooth: hci4: command 0x0419 tx timeout [ 67.541632] Bluetooth: hci0: command 0x0419 tx timeout [ 67.542452] Bluetooth: hci3: command 0x0419 tx timeout [ 67.603905] Bluetooth: hci7: command 0x0419 tx timeout [ 67.604709] Bluetooth: hci5: command 0x0419 tx timeout [ 70.291862] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 72.754556] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 72.768980] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 72.772130] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 72.782996] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 72.786982] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 72.788271] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 72.793662] Bluetooth: hci6: HCI_REQ-0x0c1a [ 74.836024] Bluetooth: hci6: command 0x0409 tx timeout [ 76.883945] Bluetooth: hci6: command 0x041b tx timeout [ 78.931917] Bluetooth: hci6: command 0x040f tx timeout [ 80.979946] Bluetooth: hci6: command 0x0419 tx timeout [ 111.033463] audit: type=1400 audit(1664891071.397:7): avc: denied { open } for pid=3755 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 13:44:51 executing program 1: io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) r0 = io_uring_setup(0x5c84, &(0x7f0000000000)={0x0, 0xdfb4, 0x0, 0x2, 0x29c}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000000c0)=[r0], 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x80202, 0x0) syz_io_uring_setup(0x3781, &(0x7f0000000140)={0x0, 0xdb69, 0x11, 0x0, 0xae, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x8, &(0x7f0000000240)=[{0x7, 0x7f, 0x1, 0x6}, {0x2, 0x85, 0x1, 0x3f}, {0x1, 0x2, 0x1, 0x5}, {0xa441, 0x3f, 0x7, 0x1}, {0x20, 0x6, 0x1, 0x3}, {0x800, 0xba, 0x4, 0x3}, {0x1f, 0x0, 0x7f, 0x41}, {0x711, 0x2, 0x9, 0x4}]}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x16) openat$full(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x6, 0x2}}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r5, 0x20, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/128, 0x80, 0x0, &(0x7f0000000500)=""/57, 0x39}, &(0x7f0000000580)=0x40) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, &(0x7f00000005c0), 0x9, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x4, &(0x7f0000000600)=[{0x101, 0x1, 0x7, 0x10001}, {0x1, 0x59, 0x80, 0x80}, {0x6, 0x0, 0x7f, 0xcb7f}, {0x7, 0x3, 0x3, 0x20}]}) syz_io_uring_setup(0x3386, &(0x7f0000000680)={0x0, 0xe77f, 0x4, 0x3, 0x2a2, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000700), &(0x7f0000000740)) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000780)={{0x1, 0x1, 0x18, r1, {0x3, 0x3}}, './file0\x00'}) io_uring_register$IORING_UNREGISTER_FILES(r6, 0x3, 0x0, 0x0) 13:44:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000600), r4) 13:44:51 executing program 3: sigaltstack(&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x20010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)="d5b3cd9986d3baa87b4ca2633c7d00067013dd5622b29cfaba7a84a7096557b60f9367bb90c4db98a3e862b9e3165860ffcdb36988ab226833e87dfaf8acd8b3a184d7deceaa0a0ba73214134e9057fef63dd8dca9e5c4bb94dcdfea9ad8be0f9e818a716871f5baa8abae5dd1a42103adb790ccc120ff359e495c12991d07ee0bf14e1b5e38bdaa4ac3e47e5bc8860f08f3bc6e2a4f10bba5285f3987663113fed1dbb36cb33fc9170a25d453373a912437efbcef63e4e43b77db00248a4d6896ce3fbd1eebdbf5d5f8214d94ef8020dd", 0xd1, 0x40800}, 0x4b) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3, 0x100}}, './file0\x00'}) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f00000001c0)={{0x0, 0x641a, 0x1, 0x5, 0x4, 0x0, 0x56, 0x9, 0x1, 0x7, 0x9000000, 0x7fffffff, 0x1ff, 0x5, 0x8}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000001200), &(0x7f0000001240), 0x2, 0x1) write$cgroup_pressure(r1, &(0x7f0000001280)={'some', 0x20, 0x2}, 0x2f) fcntl$setsig(r1, 0xa, 0x5) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f00000012c0), 0xc, &(0x7f0000001380)={&(0x7f0000001300)={0x50, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x881}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x80000000}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x24040090}, 0x4000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000001400), 0x8001, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x40010, r4, 0x10000000) clock_gettime(0x0, &(0x7f0000001440)={0x0, 0x0}) nanosleep(&(0x7f0000001480)={r5, r6+60000000}, &(0x7f00000014c0)) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r4, 0xc0189376, &(0x7f0000001500)={{0x1, 0x1, 0x18, r7, {0x40}}, './file0\x00'}) fsetxattr$security_ima(r2, &(0x7f0000001540), &(0x7f0000001580)=@v1={0x2, "38a37018d70eb909e432ed3a"}, 0xd, 0x3) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f00000015c0)) fcntl$setsig(0xffffffffffffffff, 0xa, 0x26) 13:44:51 executing program 7: r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000000)=[0xffffffffffffffff, 0xffffffffffffffff, r0], 0x3) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000040)) ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000240)) ioctl$KDSKBLED(r0, 0x4b65, 0x7a8) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280), 0x62222, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE(r1, 0x5000940e, &(0x7f00000002c0)={{r0}, "951fe09a7b1d9a9c25f8acf3976098dae180455b3912fb01ce53168d325c37bf0d713e22621f01b29e2445d317a7bf6c19c1ce72c7e542798e693c969cd9a42cab71f98e475f2b121d5645820648945e7691c224bf4c03b868f6a9b7dbbf26d4d09c972752b07c5ad110776b4b01a0040ee0494c771861e10843bc961fc0ccb03a7f7aa12d4dd454f3ef1083ae0c76fd4c974a808ef99b768fb0b79f15d1124a5db6f75e9ba17d8cb8e65b46cb911f4cfc99d6bcd382863732feede10732bb1d1ce7d7a46df9b3224cc25f7f6336ef567365d97e458b37cd87c1556e6978d678b4c2950017547d5d4b753d94356408d1fa9d016782cf858a6b13466a2a01a363b759a8beef9bb296e4bbe840e4e56807005aa3fe33cb7c2d3d9db12dddc992a32a6fc0cccb1f266386bc32a0ea35394b1464469d2e2d4e5c41884e32e32ae2b7ebd15f53b129b2b026670d971a36eda2323e60fe68266d587bc37ae10b4e105e6ee3f2bba5b1f9e2a5cabdb1daf1f4e696ae0bb9b8709e018c4dbf4b2d843a1acbd9a4b22b740cac8e10eaa492ede2241b84da293ec964b48b8254a3a9a8a3f90c043e39ad83597d29e47e3b57d59bd25567f3c041448be938067eb31556ea37512fe359ab681dc65a5934e5db055e3eb8ee551a0fc1cfe05cc5e443919b277097ea4ab7478f4e21e3b527464890800da63bbf13e23f8b08694a001ad9f31ca01dd14637249c2ef0c32495d92202d270f0c053b02b971daeeff9bc134891cadc30469d0b7a0749d886d9ed3259248b6e252cd477c198997bdd6f7da6c0f6a323d8a3b73c6fa93b4b60fe49a9996f21bec3b7d5afa2d5261743f027fca9263e83c112d8db1c02c2925128b71242a329f1dfb33e2bcea0b3c836bc58f00d12b10258d5d16ed9b9233d26d121d6f3ecf054db994b6b976dee9a15caa6867e36198e95141322886adb810ad1045beb3d061a8acf29fd86b03cc273d29b5afb7eaa6c6eed8f4570bd9f5cf9af71c9b4b65af8179b7c5a720c49260a16ef53a5a7b698bd32908267e416c3cf6c48934f08997308e26ad9b0e206ddd29b543c185adadec49e9a5bb55fcb44efc491ccabf9401939f48e1ab9aad460eeb0069d0cdd1fef58c864c1a9deb96a704f79204a38e73d4109c5e396b2d4d09adb4756ab309c4031ba2cebcb3ff5e5f01b04b30bc9c89ec1d90a3a0cf533a65ea66973ab3cd3d9186b75c54a546c0ad22b300ce1112d3fde65110ca6982f002f035595dcd54753609f80094af5033a84685c4225465ec5669e73ff9b271664c575030500d5a3dc253aecfd95491e15022362c1bd6cd94bccf6137b48f5c2564585b20fa9fb9c74fd7d8bceaf8093e18d3184764bf065401b7aa747b50fbf2baab9fb9e4defd025d2bc4da8cf7eb8d836f4ba814088ccd11d975bce4ccb98a2452310f13bf301a677461b185c0a5f2fc151d7ac12b42d3045b75edb9f4049034a6d77a722963091491d4d3982d7702eba2296e1a26a1cd7ddade2748379be162f55920bbc72a97e278cc00c72e5d4b885c1228fe62b3e437cf0ce0f2a57475e2ff135dda6286ae56f07102fd73ae5f6cbf47f8b767dadc3996b1ba05d67025b048f3f799dacee5d867c708c13ef71b6d91d35afb968436d80341641a1e470e1aa020f1d39c86a36681edae2a9d67376630e1e9c7522946693fbe98ed2bb6161052a1f0be7fbef9b5da5d2307e0a88147ffc97f5b3d3ec7b283ba8596e6349ca9ee5219188fcf3bd15ece88000d84ce5fdcc8fef8a3e43abbe1e27e415bd19cea2dd7a39b8591662e630bae339274da2734a7efc2f410d8c75a043a2c899ccd2025dabd22bbc219c1dd4fccf983f9c42b3bc362c5d7d8f482dc677c046ccfd7b45a9763b895802d90a6d304a58993c8e8377e9e21455e5b160926671ee79c2a753dafe3aeac10a02e1164b836ff69c3623c0bde1d7e641a3d9fe22cad9ac9ad4a7d1918b69966c058bfe2dc47f17d173ab7eaf8ab285e930664b5f073ee8c00c922173e0df56a87527ad20e28197ca61fcaeb61ae701662b107359e6d8dc7dd11ccc82c9d948fbacd109c134e33ec6348d3536011d153ace006fb178c9ae0bb717d49274cafb264d1ba845f34f729dcd32fa2846d8e7c2595b88ec84a8163c125a00d190c52e1a69e6ab1bbc2e33d21cf1059f37a591a5e258f9ab02d9fb7e9227265a28f7ccb50a09006ef3225c7a5a0386d4f7c390fd3c17c41cb2de586b46fbaf5a841b2da361047a6e473efea4346f002ab7c3552a1f71653c7c16f03b81b2936924d515fb5df77caac37b4da884f82b8611ef18f14fb940f1ebc3b8f9e6a49b67e07707788bc12738a5a14adb55f73eb334f5856d4ab36e72b03e3e2d00c93e896cfc5b0411bd2758d2ed13a045ceb4b15a0b1d992565f6bd4a3ac8f5f952328c5d4351e7d63321a23020bed348c69b57f947870c9518edaa1e9be69acbc3cdafd4ad0c72c14a71fbc4683a64e5d54c844bdc0e68a78232eae7d8c05347d04218610f421e2a78366b955b1b8da021799d47b35a94ae65d039ee788f95d74611108733952c03882a292a0d6110fd8fbf1b0dfbe448dd46b25add566b26183f25185df4b64d132900451d8a2b3e68128b9ee5c35fd962802c5f830458cd4712e939e311dab710502b4975a46393afcb318f9966e3a271fe3b1f735c4820aae2a3feb1ce10b40f24b60f8a2b60fbada2dac7c45d0650a65138e77e719ec520fe6e7a3c8df85f78b8e3b8ca497acdb078b2209ec1e20d65a42498474bafbaf41fccef9c1c16207a3bb1792c41d6ff19ba1013634485f5c1d555ec7bdcbb927b1a5827c08fb38d989345b22a356d5a46497357625a973cd90da9793aad2846f606482d64a184838f55a2146b7ea22150f6875d0063766e2e9dd11d4371d8eda96ca343778fae0666b726041d2c3ec3230d7d122e9c6e632d7239a3f3d8181927d22133e608223263868ba5a94ff4395913676cf044b610a99c1584ed34c73d9969e41c6413dec9c00d9be98db7d775bf4cb121de74b6bc100afc2d237122f5bad5255a87651ceeac716d2e42cfd7a22431b69bc142cb4dcbd44168eee396a6f75cfd5fe3f200685420bf80267d16d3342029253e91b718d0ddf55fcebb85fc8044e2d7f6b3bd4004e24ee81494f334b21fa6dedeb40e66d9bb2d9d3de53abda3b421f08a6abd10b6e80dfa8dc6b7108ab9cd8c1c45fcfd400605f5f068636e2384d3df54be5fa9fa01657b664d4e6e14abb8a339823ba9e98612ed4f34749b748282e4a0524a4da1503f013d024521b345c39c8aff9b441f546244a003c70987f0bd52c03a0f2fad9e6dfe0c2d3dfeee74576d0ff571cab49571727d69a33b0a9b2cc87b3362e088df07aae008c1675f12062bcfbea78c2e914689611d4daebbd05d395474a1b9453a34263b8481208579f133566cadfa345fcc4a85aef5f0e24949138f788fde76cc1a5ef31a21feb982fbe22242cb62e8817f43847f4a5de51e590c361849c868fc276a04324e34c8b1d47c3dda562e3e4001c1455cb59e16561e58acef691e8a8fcbb8c89de1e85f7e7ce64d91bb6362efd08b6c2c8bd80ff833091a15a474b623bfd03f6b3514e6d6a471a137cbc54d1e99acc61608438de19a54c04fa2b6e59bff3f2e25348d558496e52826470c22f63cbbdef994c13b0b6c842b3e8c34d765068c7a0d5d0d53fb481fac5777e93c5617a7ab3574330437a1bb0e9479001f56aaddf1208bf43292f82c2cf2a1917e5afc4b1cb8f66ad302567ebb7ec50e44549664b6a0e170bc38e28bd5c2d7cf2c7ede27fe539ea9f3a6add73c789e1180c004759a79e84f0449b53a574588397b8b500792ba58ba679e9f5ff5010c8c70846a0dfa5bf409aa97403881ecd559d2642a4adc27270809ed0c5ce159c803a0ac6f44911cffd9d0cdf1df9a773c35f3ccf8b99b5e44d8445cde5fd84efa1083216ff6088200c0f8391d719bd22d7552ab838e8bc567b658c9ad9b255f78d0a79b07ae41ba4aba6334bf7909ceb57b7112383d2568e2d84277752050e536fef52ff1ca82960a1e7a099889ca283ccc3add5bf7f5dd7b819127db9ddd0c0071eaa2d17ef5faa388dfbddbda3d493d63873143f91165bc0077b476997e773f42e1be5c3a4d61d9a9af979fe17d57c2e462a79936677daa6960798ba2c5e5f2846d997cea543b518d1d4a13bccdad4252a6f23382df3eb5f3ea3012316db9261119833630105322b7cc6eca6e1e9c8e3a1db70dcb2b470aafd907d094ac23a61a94068a65cf5e47ad82fa2162c88f53fd626cf7f4f2870de12319e081572a56b2010d2aebd4bc5dfe5b3f3e01a2a3b1e2910365f47652e0e5df5245538ae49a95727a1687c0d9f92f672d45eb757c8eb710a95d4c0bf6586111818c6b6873ed400b3cca01db06514257be5dc3b20b4898eec5bb5df70d6f1917ae12b29e6f9df2effaad9a622af2625836997cd5a9d14e90844e9894fd3d316a7a129c29df0023fe8771711f46f312850d999fbfc68362391e7a3b34e22315b51c1ccb1f098b9a4a68331444c58afd64a89837fa3dce2edb8541281fc86f56c4be06225046ae62a950cf24a26b33e785e35d3e230f4aa56c16cf52e906bef6ba23ed85ede3abd28fb31bc46c0cb7c6e8bc93a65784f2d298722d89b96d073b532fd25eda67a0d4bd67e2926edad6112bd85338c7e063d13e5214bda62c76c49cfa9f3402ae2f2166fb1160506a5c8a7c1f8bc7405f3e6cfa9cc4f2aee8e2031d738927443d7f2f637fedef690ad0282e036026e3a4a8e00c03f6665f1fdf959f351d3511ac1bccba5ebcc4e0f7ce68533420ae84cce4f09d7388395fc9e14b2c05d1bedc4d7978ea97329052deb8a06529f31b6bde5b713637c496da021f3589fa2ee985f6c578922be9fcd13e019e1e4ea5e6f45bd5c677a56028f2c0461c253f467644fbaeb8d0ad033723c3514e14a098436c8ea93693ec4ae18a5f6baa9bfb7cdcb562522c63c8501db4c3b06e8e59046adcafc80d7a28ea82411675183f735f598b4a09606c155c81c50bfa248667ec9f0c1dba47c6f0e9c2d023cdc0423e09c1f2edf27c5475822510c8e342336769bdd190e84dd874c73ca75a1a36924db338ebe779d27285029351f69565fe3fd652b7983be29c5a74e07676ecf3420f84b8503957aaed36efca22bc1e3ad5de36bfd9c38eacd01f533216c0dcadba9988aa931f62566ab3fa491359f9487871f1473b6a04892247e43d87ab40ca21f2955b8e581e67ad01389f9c2b4476f3e7bde0f5ce8fb43e4d89e00a4158184c31014455914ec5c0253fc253e4239f53bebc1b1f15493e3c1f45983560f4bbc8263cc1236cb2a8bd045e6a277d71f0b8359b3ca339c58c4add0385ffd8d8668aaa252374684a1276ad3c2f47cc14dac1d8ab5a965978e4e6ae3e7c4a3461bfe28c893ce6bb7f639895148c2d030a52a4a07c2dd13c935e9223c86c2ccfbe9d6620ec56a07c637700f43833485f2103f326f30bbcdeba12449f0fbb015832e995d09db0ba576df8497eece2ba4c8817cc96474b99b30b95fc02f395f69881bb357412386e09e5f5a8e180a39d734a59cc4660c80ad18b5cf32ea6a931f55c16bc02993685bb99670910364d4857d36ecd8218780037382a6ba46798bf7bc0e3ab111ccf8d109a4a12fa1169d8d8a9ab4c6ddf86113a82eb38495e9f8c342f4fa5257d9868988e33d66faf9777ed015ae5bc42a7a07fdde8e0819a386c46b3fbeb"}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000012c0), 0x1, 0x0) write$rfkill(r2, &(0x7f0000001300)={0x20, 0x8}, 0x8) r3 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$binfmt_script(r3, &(0x7f0000001340)={'#! ', './file0', [{0x20, '/dev/bsg\x00'}, {0x20, '/dev/full\x00'}, {0x20, '/dev/bsg\x00'}, {0x20, '/'}, {0x20, '/dev/full\x00'}], 0xa, "4cf76a8bc9066989dda0ea767a4abe786077527f7e55c53f2628a121d4c6fc7db8508170aace749f33e83340bd05880ccb56d65839398b30600b7f2704"}, 0x74) r4 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_ACTIVATE(r4, 0x5606, 0x8) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f00000013c0)=""/4096) perf_event_open(&(0x7f00000023c0)={0x2, 0x80, 0x8, 0x58, 0x3a, 0x20, 0x0, 0x5, 0x20044, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x4, 0x4, @perf_config_ext={0x8, 0x1f}, 0x2001, 0x80000001, 0x1, 0x9, 0x5, 0x8, 0x6, 0x0, 0x2, 0x0, 0x2}, 0x0, 0xa, r1, 0x2) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000002480)={0x1, &(0x7f0000002440)=[{}]}) r5 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCL_UNBLANKSCREEN(r5, 0x541c, &(0x7f00000024c0)) openat$full(0xffffffffffffff9c, &(0x7f0000002500), 0x802, 0x0) 13:44:51 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x202382, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000480)=[r3, r5, r6, r2], 0x4) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x40010, r2, 0x8000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000500)) 13:44:51 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write$binfmt_script(r4, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '!'}, {}, {0x20, '\x00'}, {0x20, '/dev/nvram\x00'}, {0x20, ')\\+'}, {0x20, '\x00'}], 0xa, "988400f5490c5d555c1af73d5afbe95ddf48ba197d6cfb8699efa20f507a9025bcaea778f6954e98002ab42ac0255d565a4ba6019a95b8d3d0515efd39e88fa2ad4ce882aa13e298564e09602e548a5ff9ea50413a14689fd5955786509c26cfb7cb98ece1e074c0ffa18bde6559a83a5903efabf9e3164fe37cc5e73e19013aca92ac05c1e2a70a1fb60aacf8554942c9a6599dc27b4866d3081d8d2da53b91c05f99cb9411e2641e93408c8a0e8c72dd5cd83aa16f192ee0198c137fe3554400ba0cdf1c9be8099628bbe1d88ecb69c0a430974ae30237cc462324db75808dbdfb32"}, 0x105) r6 = fork() ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000700)={r6, 0x0, 0x400}) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000780)={r6}) 13:44:51 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) ioctl$PIO_UNIMAP(r7, 0x4b67, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x800, 0x4}]}) ioctl$TIOCGETD(r7, 0x5424, &(0x7f0000000700)) socket$nl_generic(0x10, 0x3, 0x10) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000780)={0x6, &(0x7f0000000740)=[{0xfff, 0x3f, 0x5, 0x7}, {0x4, 0x20, 0x80, 0x6}, {0x7, 0x7, 0x9, 0x1f}, {0x6, 0x3, 0x2, 0x2}, {0x4, 0x6b, 0x3, 0xaf38}, {0xfffe, 0x7f, 0xf9, 0x7fff}]}) fsetxattr$trusted_overlay_origin(r8, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000008c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xc00}}, './file0\x00'}) 13:44:51 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) r5 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmat(r5, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r6 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil) shmat(r6, &(0x7f0000ffd000/0x1000)=nil, 0x2000) r7 = request_key(&(0x7f00000005c0)='trusted\x00', &(0x7f0000000600)={'syz', 0x3}, &(0x7f0000000640)='/proc/crypto\x00', r4) keyctl$get_persistent(0x16, 0xee01, r7) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000006c0)=r2, 0x1) 13:44:51 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000600), r4) 13:44:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000600), r4) 13:44:51 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) r5 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmat(r5, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r6 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil) shmat(r6, &(0x7f0000ffd000/0x1000)=nil, 0x2000) r7 = request_key(&(0x7f00000005c0)='trusted\x00', &(0x7f0000000600)={'syz', 0x3}, &(0x7f0000000640)='/proc/crypto\x00', r4) keyctl$get_persistent(0x16, 0xee01, r7) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000006c0)=r2, 0x1) 13:44:51 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write$binfmt_script(r4, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '!'}, {}, {0x20, '\x00'}, {0x20, '/dev/nvram\x00'}, {0x20, ')\\+'}, {0x20, '\x00'}], 0xa, "988400f5490c5d555c1af73d5afbe95ddf48ba197d6cfb8699efa20f507a9025bcaea778f6954e98002ab42ac0255d565a4ba6019a95b8d3d0515efd39e88fa2ad4ce882aa13e298564e09602e548a5ff9ea50413a14689fd5955786509c26cfb7cb98ece1e074c0ffa18bde6559a83a5903efabf9e3164fe37cc5e73e19013aca92ac05c1e2a70a1fb60aacf8554942c9a6599dc27b4866d3081d8d2da53b91c05f99cb9411e2641e93408c8a0e8c72dd5cd83aa16f192ee0198c137fe3554400ba0cdf1c9be8099628bbe1d88ecb69c0a430974ae30237cc462324db75808dbdfb32"}, 0x105) r6 = fork() ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000700)={r6, 0x0, 0x400}) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000780)={r6}) 13:45:03 executing program 3: sigaltstack(&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x20010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)="d5b3cd9986d3baa87b4ca2633c7d00067013dd5622b29cfaba7a84a7096557b60f9367bb90c4db98a3e862b9e3165860ffcdb36988ab226833e87dfaf8acd8b3a184d7deceaa0a0ba73214134e9057fef63dd8dca9e5c4bb94dcdfea9ad8be0f9e818a716871f5baa8abae5dd1a42103adb790ccc120ff359e495c12991d07ee0bf14e1b5e38bdaa4ac3e47e5bc8860f08f3bc6e2a4f10bba5285f3987663113fed1dbb36cb33fc9170a25d453373a912437efbcef63e4e43b77db00248a4d6896ce3fbd1eebdbf5d5f8214d94ef8020dd", 0xd1, 0x40800}, 0x4b) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3, 0x100}}, './file0\x00'}) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f00000001c0)={{0x0, 0x641a, 0x1, 0x5, 0x4, 0x0, 0x56, 0x9, 0x1, 0x7, 0x9000000, 0x7fffffff, 0x1ff, 0x5, 0x8}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000001200), &(0x7f0000001240), 0x2, 0x1) write$cgroup_pressure(r1, &(0x7f0000001280)={'some', 0x20, 0x2}, 0x2f) fcntl$setsig(r1, 0xa, 0x5) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f00000012c0), 0xc, &(0x7f0000001380)={&(0x7f0000001300)={0x50, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x881}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x80000000}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x24040090}, 0x4000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000001400), 0x8001, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x40010, r4, 0x10000000) clock_gettime(0x0, &(0x7f0000001440)={0x0, 0x0}) nanosleep(&(0x7f0000001480)={r5, r6+60000000}, &(0x7f00000014c0)) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r4, 0xc0189376, &(0x7f0000001500)={{0x1, 0x1, 0x18, r7, {0x40}}, './file0\x00'}) fsetxattr$security_ima(r2, &(0x7f0000001540), &(0x7f0000001580)=@v1={0x2, "38a37018d70eb909e432ed3a"}, 0xd, 0x3) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f00000015c0)) fcntl$setsig(0xffffffffffffffff, 0xa, 0x26) 13:45:03 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000600), r4) 13:45:03 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) r5 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmat(r5, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r6 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil) shmat(r6, &(0x7f0000ffd000/0x1000)=nil, 0x2000) r7 = request_key(&(0x7f00000005c0)='trusted\x00', &(0x7f0000000600)={'syz', 0x3}, &(0x7f0000000640)='/proc/crypto\x00', r4) keyctl$get_persistent(0x16, 0xee01, r7) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000006c0)=r2, 0x1) 13:45:03 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x202382, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000480)=[r3, r5, r6, r2], 0x4) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x40010, r2, 0x8000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000500)) 13:45:03 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) ioctl$PIO_UNIMAP(r7, 0x4b67, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x800, 0x4}]}) ioctl$TIOCGETD(r7, 0x5424, &(0x7f0000000700)) socket$nl_generic(0x10, 0x3, 0x10) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000780)={0x6, &(0x7f0000000740)=[{0xfff, 0x3f, 0x5, 0x7}, {0x4, 0x20, 0x80, 0x6}, {0x7, 0x7, 0x9, 0x1f}, {0x6, 0x3, 0x2, 0x2}, {0x4, 0x6b, 0x3, 0xaf38}, {0xfffe, 0x7f, 0xf9, 0x7fff}]}) fsetxattr$trusted_overlay_origin(r8, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000008c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xc00}}, './file0\x00'}) 13:45:03 executing program 1: io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) r0 = io_uring_setup(0x5c84, &(0x7f0000000000)={0x0, 0xdfb4, 0x0, 0x2, 0x29c}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000000c0)=[r0], 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x80202, 0x0) syz_io_uring_setup(0x3781, &(0x7f0000000140)={0x0, 0xdb69, 0x11, 0x0, 0xae, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x8, &(0x7f0000000240)=[{0x7, 0x7f, 0x1, 0x6}, {0x2, 0x85, 0x1, 0x3f}, {0x1, 0x2, 0x1, 0x5}, {0xa441, 0x3f, 0x7, 0x1}, {0x20, 0x6, 0x1, 0x3}, {0x800, 0xba, 0x4, 0x3}, {0x1f, 0x0, 0x7f, 0x41}, {0x711, 0x2, 0x9, 0x4}]}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x16) openat$full(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x6, 0x2}}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r5, 0x20, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/128, 0x80, 0x0, &(0x7f0000000500)=""/57, 0x39}, &(0x7f0000000580)=0x40) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, &(0x7f00000005c0), 0x9, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x4, &(0x7f0000000600)=[{0x101, 0x1, 0x7, 0x10001}, {0x1, 0x59, 0x80, 0x80}, {0x6, 0x0, 0x7f, 0xcb7f}, {0x7, 0x3, 0x3, 0x20}]}) syz_io_uring_setup(0x3386, &(0x7f0000000680)={0x0, 0xe77f, 0x4, 0x3, 0x2a2, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000700), &(0x7f0000000740)) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000780)={{0x1, 0x1, 0x18, r1, {0x3, 0x3}}, './file0\x00'}) io_uring_register$IORING_UNREGISTER_FILES(r6, 0x3, 0x0, 0x0) 13:45:03 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000600), r4) 13:45:03 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write$binfmt_script(r4, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '!'}, {}, {0x20, '\x00'}, {0x20, '/dev/nvram\x00'}, {0x20, ')\\+'}, {0x20, '\x00'}], 0xa, "988400f5490c5d555c1af73d5afbe95ddf48ba197d6cfb8699efa20f507a9025bcaea778f6954e98002ab42ac0255d565a4ba6019a95b8d3d0515efd39e88fa2ad4ce882aa13e298564e09602e548a5ff9ea50413a14689fd5955786509c26cfb7cb98ece1e074c0ffa18bde6559a83a5903efabf9e3164fe37cc5e73e19013aca92ac05c1e2a70a1fb60aacf8554942c9a6599dc27b4866d3081d8d2da53b91c05f99cb9411e2641e93408c8a0e8c72dd5cd83aa16f192ee0198c137fe3554400ba0cdf1c9be8099628bbe1d88ecb69c0a430974ae30237cc462324db75808dbdfb32"}, 0x105) r6 = fork() ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000700)={r6, 0x0, 0x400}) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000780)={r6}) 13:45:03 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) r5 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmat(r5, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r6 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil) shmat(r6, &(0x7f0000ffd000/0x1000)=nil, 0x2000) r7 = request_key(&(0x7f00000005c0)='trusted\x00', &(0x7f0000000600)={'syz', 0x3}, &(0x7f0000000640)='/proc/crypto\x00', r4) keyctl$get_persistent(0x16, 0xee01, r7) 13:45:03 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x202382, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000480)=[r3, r5, r6, r2], 0x4) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x40010, r2, 0x8000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGDEV(0xffffffffffffffff, 0x80045432, &(0x7f0000000500)) 13:45:03 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000600), r4) 13:45:03 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) 13:45:03 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) ioctl$PIO_UNIMAP(r7, 0x4b67, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x800, 0x4}]}) ioctl$TIOCGETD(r7, 0x5424, &(0x7f0000000700)) socket$nl_generic(0x10, 0x3, 0x10) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000780)={0x6, &(0x7f0000000740)=[{0xfff, 0x3f, 0x5, 0x7}, {0x4, 0x20, 0x80, 0x6}, {0x7, 0x7, 0x9, 0x1f}, {0x6, 0x3, 0x2, 0x2}, {0x4, 0x6b, 0x3, 0xaf38}, {0xfffe, 0x7f, 0xf9, 0x7fff}]}) fsetxattr$trusted_overlay_origin(r8, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000008c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xc00}}, './file0\x00'}) 13:45:03 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) r5 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmat(r5, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r6 = shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil) shmat(r6, &(0x7f0000ffd000/0x1000)=nil, 0x2000) keyctl$get_persistent(0x16, 0xee01, 0x0) 13:45:03 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 13:45:03 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r2, {0x9, 0x5}}, './file1\x00'}) 13:45:16 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) ioctl$PIO_UNIMAP(r7, 0x4b67, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x800, 0x4}]}) ioctl$TIOCGETD(r7, 0x5424, &(0x7f0000000700)) socket$nl_generic(0x10, 0x3, 0x10) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000780)={0x6, &(0x7f0000000740)=[{0xfff, 0x3f, 0x5, 0x7}, {0x4, 0x20, 0x80, 0x6}, {0x7, 0x7, 0x9, 0x1f}, {0x6, 0x3, 0x2, 0x2}, {0x4, 0x6b, 0x3, 0xaf38}, {0xfffe, 0x7f, 0xf9, 0x7fff}]}) fsetxattr$trusted_overlay_origin(r8, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) 13:45:16 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000580)={0x6, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}]}) 13:45:16 executing program 3: sigaltstack(&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x20010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)="d5b3cd9986d3baa87b4ca2633c7d00067013dd5622b29cfaba7a84a7096557b60f9367bb90c4db98a3e862b9e3165860ffcdb36988ab226833e87dfaf8acd8b3a184d7deceaa0a0ba73214134e9057fef63dd8dca9e5c4bb94dcdfea9ad8be0f9e818a716871f5baa8abae5dd1a42103adb790ccc120ff359e495c12991d07ee0bf14e1b5e38bdaa4ac3e47e5bc8860f08f3bc6e2a4f10bba5285f3987663113fed1dbb36cb33fc9170a25d453373a912437efbcef63e4e43b77db00248a4d6896ce3fbd1eebdbf5d5f8214d94ef8020dd", 0xd1, 0x40800}, 0x4b) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3, 0x100}}, './file0\x00'}) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f00000001c0)={{0x0, 0x641a, 0x1, 0x5, 0x4, 0x0, 0x56, 0x9, 0x1, 0x7, 0x9000000, 0x7fffffff, 0x1ff, 0x5, 0x8}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000001200), &(0x7f0000001240), 0x2, 0x1) write$cgroup_pressure(r1, &(0x7f0000001280)={'some', 0x20, 0x2}, 0x2f) fcntl$setsig(r1, 0xa, 0x5) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f00000012c0), 0xc, &(0x7f0000001380)={&(0x7f0000001300)={0x50, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x881}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x80000000}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x24040090}, 0x4000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000001400), 0x8001, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x40010, r4, 0x10000000) clock_gettime(0x0, &(0x7f0000001440)={0x0, 0x0}) nanosleep(&(0x7f0000001480)={r5, r6+60000000}, &(0x7f00000014c0)) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r4, 0xc0189376, &(0x7f0000001500)={{0x1, 0x1, 0x18, r7, {0x40}}, './file0\x00'}) fsetxattr$security_ima(r2, &(0x7f0000001540), &(0x7f0000001580)=@v1={0x2, "38a37018d70eb909e432ed3a"}, 0xd, 0x3) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f00000015c0)) fcntl$setsig(0xffffffffffffffff, 0xa, 0x26) 13:45:16 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x202382, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000480)=[r3, r5, r6, r2], 0x4) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x40010, r2, 0x8000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 13:45:16 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) 13:45:16 executing program 1: io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) r0 = io_uring_setup(0x5c84, &(0x7f0000000000)={0x0, 0xdfb4, 0x0, 0x2, 0x29c}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000000c0)=[r0], 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x80202, 0x0) syz_io_uring_setup(0x3781, &(0x7f0000000140)={0x0, 0xdb69, 0x11, 0x0, 0xae, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x8, &(0x7f0000000240)=[{0x7, 0x7f, 0x1, 0x6}, {0x2, 0x85, 0x1, 0x3f}, {0x1, 0x2, 0x1, 0x5}, {0xa441, 0x3f, 0x7, 0x1}, {0x20, 0x6, 0x1, 0x3}, {0x800, 0xba, 0x4, 0x3}, {0x1f, 0x0, 0x7f, 0x41}, {0x711, 0x2, 0x9, 0x4}]}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x16) openat$full(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x6, 0x2}}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r5, 0x20, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/128, 0x80, 0x0, &(0x7f0000000500)=""/57, 0x39}, &(0x7f0000000580)=0x40) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, &(0x7f00000005c0), 0x9, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x4, &(0x7f0000000600)=[{0x101, 0x1, 0x7, 0x10001}, {0x1, 0x59, 0x80, 0x80}, {0x6, 0x0, 0x7f, 0xcb7f}, {0x7, 0x3, 0x3, 0x20}]}) syz_io_uring_setup(0x3386, &(0x7f0000000680)={0x0, 0xe77f, 0x4, 0x3, 0x2a2, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000700), &(0x7f0000000740)) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000780)={{0x1, 0x1, 0x18, r1, {0x3, 0x3}}, './file0\x00'}) io_uring_register$IORING_UNREGISTER_FILES(r6, 0x3, 0x0, 0x0) 13:45:16 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) r5 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmat(r5, &(0x7f0000ffe000/0x2000)=nil, 0x2000) shmget$private(0x0, 0x4000, 0x100, &(0x7f0000ffc000/0x4000)=nil) keyctl$get_persistent(0x16, 0xee01, 0x0) 13:45:16 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write$binfmt_script(r4, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '!'}, {}, {0x20, '\x00'}, {0x20, '/dev/nvram\x00'}, {0x20, ')\\+'}, {0x20, '\x00'}], 0xa, "988400f5490c5d555c1af73d5afbe95ddf48ba197d6cfb8699efa20f507a9025bcaea778f6954e98002ab42ac0255d565a4ba6019a95b8d3d0515efd39e88fa2ad4ce882aa13e298564e09602e548a5ff9ea50413a14689fd5955786509c26cfb7cb98ece1e074c0ffa18bde6559a83a5903efabf9e3164fe37cc5e73e19013aca92ac05c1e2a70a1fb60aacf8554942c9a6599dc27b4866d3081d8d2da53b91c05f99cb9411e2641e93408c8a0e8c72dd5cd83aa16f192ee0198c137fe3554400ba0cdf1c9be8099628bbe1d88ecb69c0a430974ae30237cc462324db75808dbdfb32"}, 0x105) r6 = fork() ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000700)={r6, 0x0, 0x400}) 13:45:16 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) ioctl$PIO_UNIMAP(r7, 0x4b67, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x800, 0x4}]}) ioctl$TIOCGETD(r7, 0x5424, &(0x7f0000000700)) socket$nl_generic(0x10, 0x3, 0x10) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) 13:45:16 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) r5 = shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) shmat(r5, &(0x7f0000ffe000/0x2000)=nil, 0x2000) keyctl$get_persistent(0x16, 0xee01, 0x0) 13:45:16 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)) 13:45:16 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f0000000500)=r7) 13:45:16 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x202382, 0x0) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000480)=[r3, r5, r6, r2], 0x4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 13:45:16 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) ioctl$PIO_UNIMAP(r7, 0x4b67, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x800, 0x4}]}) ioctl$TIOCGETD(r7, 0x5424, &(0x7f0000000700)) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) 13:45:16 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r4, 0x4b44, &(0x7f0000000400)) r5 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r5, 0xa, 0x39) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r3, 0x40082102, &(0x7f0000000500)) 13:45:16 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000480)) 13:45:16 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) shmget$private(0x0, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) keyctl$get_persistent(0x16, 0xee01, 0x0) 13:45:28 executing program 3: sigaltstack(&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x20010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)="d5b3cd9986d3baa87b4ca2633c7d00067013dd5622b29cfaba7a84a7096557b60f9367bb90c4db98a3e862b9e3165860ffcdb36988ab226833e87dfaf8acd8b3a184d7deceaa0a0ba73214134e9057fef63dd8dca9e5c4bb94dcdfea9ad8be0f9e818a716871f5baa8abae5dd1a42103adb790ccc120ff359e495c12991d07ee0bf14e1b5e38bdaa4ac3e47e5bc8860f08f3bc6e2a4f10bba5285f3987663113fed1dbb36cb33fc9170a25d453373a912437efbcef63e4e43b77db00248a4d6896ce3fbd1eebdbf5d5f8214d94ef8020dd", 0xd1, 0x40800}, 0x4b) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3, 0x100}}, './file0\x00'}) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f00000001c0)={{0x0, 0x641a, 0x1, 0x5, 0x4, 0x0, 0x56, 0x9, 0x1, 0x7, 0x9000000, 0x7fffffff, 0x1ff, 0x5, 0x8}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000001200), &(0x7f0000001240), 0x2, 0x1) write$cgroup_pressure(r1, &(0x7f0000001280)={'some', 0x20, 0x2}, 0x2f) fcntl$setsig(r1, 0xa, 0x5) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f00000012c0), 0xc, &(0x7f0000001380)={&(0x7f0000001300)={0x50, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x881}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x80000000}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x24040090}, 0x4000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000001400), 0x8001, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x40010, r4, 0x10000000) clock_gettime(0x0, &(0x7f0000001440)={0x0, 0x0}) nanosleep(&(0x7f0000001480)={r5, r6+60000000}, &(0x7f00000014c0)) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r4, 0xc0189376, &(0x7f0000001500)={{0x1, 0x1, 0x18, r7, {0x40}}, './file0\x00'}) fsetxattr$security_ima(r2, &(0x7f0000001540), &(0x7f0000001580)=@v1={0x2, "38a37018d70eb909e432ed3a"}, 0xd, 0x3) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f00000015c0)) 13:45:28 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) r7 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) ioctl$PIO_UNIMAP(r7, 0x4b67, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x800, 0x4}]}) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) 13:45:28 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x202382, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 13:45:28 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f0000000400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r6, 0xa, 0x39) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000440)={0x0, 0x9, 0x9}) 13:45:28 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write$binfmt_script(r4, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '!'}, {}, {0x20, '\x00'}, {0x20, '/dev/nvram\x00'}, {0x20, ')\\+'}, {0x20, '\x00'}], 0xa, "988400f5490c5d555c1af73d5afbe95ddf48ba197d6cfb8699efa20f507a9025bcaea778f6954e98002ab42ac0255d565a4ba6019a95b8d3d0515efd39e88fa2ad4ce882aa13e298564e09602e548a5ff9ea50413a14689fd5955786509c26cfb7cb98ece1e074c0ffa18bde6559a83a5903efabf9e3164fe37cc5e73e19013aca92ac05c1e2a70a1fb60aacf8554942c9a6599dc27b4866d3081d8d2da53b91c05f99cb9411e2641e93408c8a0e8c72dd5cd83aa16f192ee0198c137fe3554400ba0cdf1c9be8099628bbe1d88ecb69c0a430974ae30237cc462324db75808dbdfb32"}, 0x105) fork() 13:45:28 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r4, 0x4b44, &(0x7f0000000400)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r3, 0x40082102, &(0x7f0000000500)) 13:45:28 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000580)) keyctl$get_persistent(0x16, 0xee01, 0x0) 13:45:28 executing program 1: io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) r0 = io_uring_setup(0x5c84, &(0x7f0000000000)={0x0, 0xdfb4, 0x0, 0x2, 0x29c}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000000c0)=[r0], 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x80202, 0x0) syz_io_uring_setup(0x3781, &(0x7f0000000140)={0x0, 0xdb69, 0x11, 0x0, 0xae, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x8, &(0x7f0000000240)=[{0x7, 0x7f, 0x1, 0x6}, {0x2, 0x85, 0x1, 0x3f}, {0x1, 0x2, 0x1, 0x5}, {0xa441, 0x3f, 0x7, 0x1}, {0x20, 0x6, 0x1, 0x3}, {0x800, 0xba, 0x4, 0x3}, {0x1f, 0x0, 0x7f, 0x41}, {0x711, 0x2, 0x9, 0x4}]}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x16) openat$full(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x6, 0x2}}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r5, 0x20, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/128, 0x80, 0x0, &(0x7f0000000500)=""/57, 0x39}, &(0x7f0000000580)=0x40) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, &(0x7f00000005c0), 0x9, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x4, &(0x7f0000000600)=[{0x101, 0x1, 0x7, 0x10001}, {0x1, 0x59, 0x80, 0x80}, {0x6, 0x0, 0x7f, 0xcb7f}, {0x7, 0x3, 0x3, 0x20}]}) syz_io_uring_setup(0x3386, &(0x7f0000000680)={0x0, 0xe77f, 0x4, 0x3, 0x2a2, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000700), &(0x7f0000000740)) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000780)={{0x1, 0x1, 0x18, r1, {0x3, 0x3}}, './file0\x00'}) 13:45:28 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r4, 0x4b44, &(0x7f0000000400)) r5 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r5, 0xa, 0x39) 13:45:28 executing program 1: io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) r0 = io_uring_setup(0x5c84, &(0x7f0000000000)={0x0, 0xdfb4, 0x0, 0x2, 0x29c}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000000c0)=[r0], 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x80202, 0x0) syz_io_uring_setup(0x3781, &(0x7f0000000140)={0x0, 0xdb69, 0x11, 0x0, 0xae, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x8, &(0x7f0000000240)=[{0x7, 0x7f, 0x1, 0x6}, {0x2, 0x85, 0x1, 0x3f}, {0x1, 0x2, 0x1, 0x5}, {0xa441, 0x3f, 0x7, 0x1}, {0x20, 0x6, 0x1, 0x3}, {0x800, 0xba, 0x4, 0x3}, {0x1f, 0x0, 0x7f, 0x41}, {0x711, 0x2, 0x9, 0x4}]}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x16) openat$full(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x6, 0x2}}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r5, 0x20, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/128, 0x80, 0x0, &(0x7f0000000500)=""/57, 0x39}, &(0x7f0000000580)=0x40) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, &(0x7f00000005c0), 0x9, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x4, &(0x7f0000000600)=[{0x101, 0x1, 0x7, 0x10001}, {0x1, 0x59, 0x80, 0x80}, {0x6, 0x0, 0x7f, 0xcb7f}, {0x7, 0x3, 0x3, 0x20}]}) syz_io_uring_setup(0x3386, &(0x7f0000000680)={0x0, 0xe77f, 0x4, 0x3, 0x2a2, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000700), &(0x7f0000000740)) 13:45:28 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x202382, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 13:45:29 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000000500)) keyctl$get_persistent(0x16, 0xee01, 0x0) 13:45:29 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 13:45:29 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r4, 0x4b44, &(0x7f0000000400)) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r3, 0x40082102, &(0x7f0000000500)) 13:45:29 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) openat$hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x640400, 0x0) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) 13:45:29 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write$binfmt_script(r4, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '!'}, {}, {0x20, '\x00'}, {0x20, '/dev/nvram\x00'}, {0x20, ')\\+'}, {0x20, '\x00'}], 0xa, "988400f5490c5d555c1af73d5afbe95ddf48ba197d6cfb8699efa20f507a9025bcaea778f6954e98002ab42ac0255d565a4ba6019a95b8d3d0515efd39e88fa2ad4ce882aa13e298564e09602e548a5ff9ea50413a14689fd5955786509c26cfb7cb98ece1e074c0ffa18bde6559a83a5903efabf9e3164fe37cc5e73e19013aca92ac05c1e2a70a1fb60aacf8554942c9a6599dc27b4866d3081d8d2da53b91c05f99cb9411e2641e93408c8a0e8c72dd5cd83aa16f192ee0198c137fe3554400ba0cdf1c9be8099628bbe1d88ecb69c0a430974ae30237cc462324db75808dbdfb32"}, 0x105) fork() [ 183.763939] Bluetooth: hci0: command 0x0406 tx timeout [ 183.764070] Bluetooth: hci2: command 0x0406 tx timeout [ 183.764647] Bluetooth: hci5: command 0x0406 tx timeout [ 183.765617] Bluetooth: hci7: command 0x0406 tx timeout [ 183.766243] Bluetooth: hci1: command 0x0406 tx timeout [ 183.767214] Bluetooth: hci3: command 0x0406 tx timeout [ 183.767822] Bluetooth: hci4: command 0x0406 tx timeout 13:45:45 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write$binfmt_script(r4, &(0x7f00000005c0)={'#! ', './file0', [{0x20, '!'}, {}, {0x20, '\x00'}, {0x20, '/dev/nvram\x00'}, {0x20, ')\\+'}, {0x20, '\x00'}], 0xa, "988400f5490c5d555c1af73d5afbe95ddf48ba197d6cfb8699efa20f507a9025bcaea778f6954e98002ab42ac0255d565a4ba6019a95b8d3d0515efd39e88fa2ad4ce882aa13e298564e09602e548a5ff9ea50413a14689fd5955786509c26cfb7cb98ece1e074c0ffa18bde6559a83a5903efabf9e3164fe37cc5e73e19013aca92ac05c1e2a70a1fb60aacf8554942c9a6599dc27b4866d3081d8d2da53b91c05f99cb9411e2641e93408c8a0e8c72dd5cd83aa16f192ee0198c137fe3554400ba0cdf1c9be8099628bbe1d88ecb69c0a430974ae30237cc462324db75808dbdfb32"}, 0x105) fork() 13:45:45 executing program 3: sigaltstack(&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x20010, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)="d5b3cd9986d3baa87b4ca2633c7d00067013dd5622b29cfaba7a84a7096557b60f9367bb90c4db98a3e862b9e3165860ffcdb36988ab226833e87dfaf8acd8b3a184d7deceaa0a0ba73214134e9057fef63dd8dca9e5c4bb94dcdfea9ad8be0f9e818a716871f5baa8abae5dd1a42103adb790ccc120ff359e495c12991d07ee0bf14e1b5e38bdaa4ac3e47e5bc8860f08f3bc6e2a4f10bba5285f3987663113fed1dbb36cb33fc9170a25d453373a912437efbcef63e4e43b77db00248a4d6896ce3fbd1eebdbf5d5f8214d94ef8020dd", 0xd1, 0x40800}, 0x4b) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3, 0x100}}, './file0\x00'}) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f00000001c0)={{0x0, 0x641a, 0x1, 0x5, 0x4, 0x0, 0x56, 0x9, 0x1, 0x7, 0x9000000, 0x7fffffff, 0x1ff, 0x5, 0x8}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000001200), &(0x7f0000001240), 0x2, 0x1) write$cgroup_pressure(r1, &(0x7f0000001280)={'some', 0x20, 0x2}, 0x2f) fcntl$setsig(r1, 0xa, 0x5) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f00000012c0), 0xc, &(0x7f0000001380)={&(0x7f0000001300)={0x50, 0x0, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x881}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x80000000}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x24040090}, 0x4000) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000001400), 0x8001, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x40010, r4, 0x10000000) clock_gettime(0x0, &(0x7f0000001440)={0x0, 0x0}) nanosleep(&(0x7f0000001480)={r5, r6+60000000}, &(0x7f00000014c0)) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r4, 0xc0189376, &(0x7f0000001500)={{0x1, 0x1, 0x18, r7, {0x40}}, './file0\x00'}) fsetxattr$security_ima(r2, &(0x7f0000001540), &(0x7f0000001580)=@v1={0x2, "38a37018d70eb909e432ed3a"}, 0xd, 0x3) 13:45:45 executing program 1: io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) r0 = io_uring_setup(0x5c84, &(0x7f0000000000)={0x0, 0xdfb4, 0x0, 0x2, 0x29c}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000000c0)=[r0], 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x80202, 0x0) syz_io_uring_setup(0x3781, &(0x7f0000000140)={0x0, 0xdb69, 0x11, 0x0, 0xae, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x8, &(0x7f0000000240)=[{0x7, 0x7f, 0x1, 0x6}, {0x2, 0x85, 0x1, 0x3f}, {0x1, 0x2, 0x1, 0x5}, {0xa441, 0x3f, 0x7, 0x1}, {0x20, 0x6, 0x1, 0x3}, {0x800, 0xba, 0x4, 0x3}, {0x1f, 0x0, 0x7f, 0x41}, {0x711, 0x2, 0x9, 0x4}]}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x16) openat$full(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x6, 0x2}}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r5, 0x20, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/128, 0x80, 0x0, &(0x7f0000000500)=""/57, 0x39}, &(0x7f0000000580)=0x40) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, &(0x7f00000005c0), 0x9, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x4, &(0x7f0000000600)=[{0x101, 0x1, 0x7, 0x10001}, {0x1, 0x59, 0x80, 0x80}, {0x6, 0x0, 0x7f, 0xcb7f}, {0x7, 0x3, 0x3, 0x20}]}) syz_io_uring_setup(0x3386, &(0x7f0000000680)={0x0, 0xe77f, 0x4, 0x3, 0x2a2, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000700), &(0x7f0000000740)) 13:45:45 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 13:45:45 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r4, 0x4b44, &(0x7f0000000400)) socket$nl_generic(0x10, 0x3, 0x10) 13:45:45 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r3, 0x40082102, &(0x7f0000000500)) 13:45:45 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) r6 = syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) io_uring_register$IORING_UNREGISTER_BUFFERS(r6, 0x1, 0x0, 0x0) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) 13:45:45 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) r4 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$negate(0xd, 0x0, 0x3, r4) keyctl$get_persistent(0x16, 0xee01, 0x0) 13:45:45 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r3, 0x40082102, &(0x7f0000000500)) 13:45:45 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x1a) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x1, 0x2, 0x7, 0xa9e, 0x3, "07360ec5da1c4f99a6ebb06039d14da0c34eab", 0x3ff, 0x4}) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) r0 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000005, 0x10, 0xffffffffffffffff, 0x10000000) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, 0xffffffffffffffff, &(0x7f00000000c0)={0x200300, 0x40, 0x1}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x12345, {0x0, r1}}, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000001c0)={0x3ff, 0x2, 0x8, 0x5, 0x14, "e5e82a1e8a2fb0c8"}) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2, {0x80000001}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000008, 0x4000010, r3, 0x10000000) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xa0, r4, 0xd555fd90962f63ea, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xa0}, 0x1, 0x0, 0x0, 0x841}, 0x20000800) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0x7}}, './file0\x00'}) ioctl$TCXONC(r5, 0x540a, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 13:45:45 executing program 2: syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)="bbccd4c9068a9fea777f4f43df9c8dc591161e71f0e94ed725635f9981dcd97a601930ba6fd540a15f69b921ef853925bd98df7a9db142f204abcdd4462702aafa17184e1d19af11d69ceee2c2689d1e108f16678ebc7f9c848c7b621dc09cfa56a3f5bbdc12659675ba90da2dea11f168752c", 0x73, 0x40000060}, 0x391) msync(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4) r0 = io_uring_setup(0x499c, &(0x7f00000000c0)={0x0, 0x7bd3, 0x0, 0x2, 0x11a}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x10, r0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/crypto\x00', 0x0, 0x0) syz_io_uring_setup(0x3390, &(0x7f0000000180)={0x0, 0x52f5, 0x8, 0x1, 0x1f0, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000240)) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x1800) syz_io_uring_setup(0x4836, &(0x7f00000002c0)={0x0, 0x10bd, 0x10, 0x2, 0x273, 0x0, r2}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r3, 0x80047210, &(0x7f00000003c0)) add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @auto=[0x38, 0x56, 0x65, 0x31, 0x36, 0x63, 0x33, 0x34, 0x30, 0x38, 0x34, 0x62, 0x63, 0x30, 0x66, 0x62]}, &(0x7f0000000480)={0x0, "ec99a5dfb5040ac5d691861c5529592fd6fe22f36d5fe4913dcc74b5da076ae07c23b197be64607fc126088e1fb418459bb58fcca3c63b9ee971378f0428081f", 0x18}, 0x48, 0xfffffffffffffff9) keyctl$get_persistent(0x16, 0xee01, 0x0) 13:45:45 executing program 7: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x70, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1d}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x2c008040}, 0x10) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) ioctl$KDGKBMODE(r4, 0x4b44, &(0x7f0000000400)) socket$nl_generic(0x10, 0x3, 0x10) 13:45:45 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/bus/input/devices\x00', 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r3, 0x40082102, &(0x7f0000000500)) 13:45:45 executing program 6: ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000080)) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='\x00', 0x4040, 0x24) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x84, 0x0, &(0x7f00000001c0)=[@acquire={0x40046305, 0x2}, @register_looper, @enter_looper, @acquire={0x40046305, 0x1}, @release={0x40046306, 0x1}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x1000, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @release={0x40046306, 0x3}, @free_buffer={0x40086303, r2}, @exit_looper], 0x55, 0x0, &(0x7f0000000280)="d7f438ae011a43a432d0c891df2ce6cdaaa43f04ca984c206b55279081906338b5de69d4e4704cc9c3eb1b0b483bde784fd23f3db2fb06c34df3c71092ec14df32b17713c44e81549d6340c4726a31d1035d33958f"}) getpeername(r1, &(0x7f0000000340)=@xdp, &(0x7f00000003c0)=0x80) r3 = openat(r0, &(0x7f0000000400)='./file0\x00', 0x200, 0x18) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000440)='./binderfs2/binder1\x00', 0x0, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000500)={0x1c, 0x0, &(0x7f0000000480)=[@clear_death, @free_buffer={0x40086303, r5}], 0x36, 0x0, &(0x7f00000004c0)="5010885193966f5edc2bb559d37044626eb67b42ea0369ee9eb08457b7ff6a5c0e9fd88ffef32443d684cc37649eb6fe1abfe97229a5"}) syz_io_uring_setup(0x77d4, &(0x7f0000000540)={0x0, 0x27bb, 0x0, 0x3, 0x13c, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000005c0), &(0x7f0000000600)) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000007c0), &(0x7f0000000800), 0x2, 0x1) 13:45:45 executing program 1: io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) r0 = io_uring_setup(0x5c84, &(0x7f0000000000)={0x0, 0xdfb4, 0x0, 0x2, 0x29c}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f00000000c0)=[r0], 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x80202, 0x0) syz_io_uring_setup(0x3781, &(0x7f0000000140)={0x0, 0xdb69, 0x11, 0x0, 0xae, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x8, &(0x7f0000000240)=[{0x7, 0x7f, 0x1, 0x6}, {0x2, 0x85, 0x1, 0x3f}, {0x1, 0x2, 0x1, 0x5}, {0xa441, 0x3f, 0x7, 0x1}, {0x20, 0x6, 0x1, 0x3}, {0x800, 0xba, 0x4, 0x3}, {0x1f, 0x0, 0x7f, 0x41}, {0x711, 0x2, 0x9, 0x4}]}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x16) openat$full(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0x6, 0x2}}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r5, 0x20, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8001}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2000) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/128, 0x80, 0x0, &(0x7f0000000500)=""/57, 0x39}, &(0x7f0000000580)=0x40) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, &(0x7f00000005c0), 0x9, 0x5) syz_io_uring_setup(0x3386, &(0x7f0000000680)={0x0, 0xe77f, 0x4, 0x3, 0x2a2, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000700), &(0x7f0000000740)) 13:45:45 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0xfffffff9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$setsig(r1, 0xa, 0x19) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x20441, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x8800) ioctl$VT_ACTIVATE(r0, 0x5606, 0x8a6) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x40082102, &(0x7f0000000500)) 13:45:45 executing program 5: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0x20, 0x9, 0x3}, {0x8, 0x3, 0x0, 0x400}, {0x0, 0x6, 0x2, 0x7f}, {0xfffc, 0x7f, 0x3, 0x40}]}) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x20000) r1 = getpid() ptrace(0xffffffffffffffff, r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x9, 0xfc, 0xb8, 0x7}]}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x300, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000280)) getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x644, 0x0, 0x80, 0x40}, {0x0, 0x1, 0x71, 0x2}, {0x7fff, 0xf9, 0x5, 0x10000}, {0x4, 0x2, 0x7f, 0x5}, {0x4, 0x81, 0x0, 0x9}, {0x9, 0x52, 0x9, 0x9}, {0x5, 0x4, 0x0, 0xadc0}]}) r4 = syz_io_uring_setup(0x71c5, &(0x7f0000000340)={0x0, 0x2368, 0x2b, 0x0, 0xee, 0x0, r3}, &(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) ioctl$BTRFS_IOC_BALANCE_CTL(r4, 0x40049421, 0x1) io_uring_register$IORING_REGISTER_FILES_UPDATE(r3, 0x6, &(0x7f0000000480)={0x2, 0x0, &(0x7f0000000440)=[r0, r3, 0xffffffffffffffff, r3, r2]}, 0x5) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs2/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x8) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) r6 = fork() ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000700)={r6, 0x0, 0x400}) [ 185.813004] INFO: task rcu_gp:3 blocked for more than 143 seconds. [ 185.813613] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.814141] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.814956] task:rcu_gp state:I stack:30328 pid:3 ppid:2 flags:0x00004000 [ 185.815626] Call Trace: [ 185.815951] [ 185.816116] __schedule+0x893/0x2470 [ 185.816397] ? io_schedule_timeout+0x150/0x150 [ 185.817027] ? do_raw_spin_lock+0x121/0x260 [ 185.817339] ? rwlock_bug.part.0+0x90/0x90 [ 185.817852] schedule+0xda/0x1b0 [ 185.818104] rescuer_thread+0x851/0xdb0 [ 185.818390] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.818739] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.819114] ? lockdep_hardirqs_on+0x79/0x100 [ 185.819436] ? worker_thread+0x1260/0x1260 [ 185.819737] kthread+0x2ed/0x3a0 [ 185.819999] ? kthread_complete_and_exit+0x40/0x40 [ 185.820344] ret_from_fork+0x22/0x30 [ 185.820624] [ 185.820810] INFO: task rcu_par_gp:4 blocked for more than 143 seconds. [ 185.821249] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.821608] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.822136] task:rcu_par_gp state:I stack:30944 pid:4 ppid:2 flags:0x00004000 [ 185.822694] Call Trace: [ 185.822900] [ 185.823068] __schedule+0x893/0x2470 [ 185.823340] ? io_schedule_timeout+0x150/0x150 [ 185.823659] ? do_raw_spin_lock+0x121/0x260 [ 185.823977] ? rwlock_bug.part.0+0x90/0x90 [ 185.824281] schedule+0xda/0x1b0 [ 185.824527] rescuer_thread+0x851/0xdb0 [ 185.824828] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.825176] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.825522] ? lockdep_hardirqs_on+0x79/0x100 [ 185.825861] ? worker_thread+0x1260/0x1260 [ 185.826160] kthread+0x2ed/0x3a0 [ 185.826406] ? kthread_complete_and_exit+0x40/0x40 [ 185.826750] ret_from_fork+0x22/0x30 [ 185.827066] [ 185.827237] INFO: task slub_flushwq:5 blocked for more than 143 seconds. [ 185.827680] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.828058] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.828569] task:slub_flushwq state:I stack:30944 pid:5 ppid:2 flags:0x00004000 [ 185.829148] Call Trace: [ 185.829331] [ 185.829497] __schedule+0x893/0x2470 [ 185.829770] ? io_schedule_timeout+0x150/0x150 [ 185.830108] ? do_raw_spin_lock+0x121/0x260 [ 185.830415] ? rwlock_bug.part.0+0x90/0x90 [ 185.830719] schedule+0xda/0x1b0 [ 185.830993] rescuer_thread+0x851/0xdb0 [ 185.831280] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.831626] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.832010] ? lockdep_hardirqs_on+0x79/0x100 [ 185.832330] ? worker_thread+0x1260/0x1260 [ 185.832629] kthread+0x2ed/0x3a0 [ 185.832890] ? kthread_complete_and_exit+0x40/0x40 [ 185.833232] ret_from_fork+0x22/0x30 [ 185.833511] [ 185.833679] INFO: task netns:6 blocked for more than 143 seconds. [ 185.834103] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.834467] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.835007] task:netns state:I stack:30944 pid:6 ppid:2 flags:0x00004000 [ 185.835566] Call Trace: [ 185.835748] [ 185.835932] __schedule+0x893/0x2470 [ 185.836204] ? io_schedule_timeout+0x150/0x150 [ 185.836522] ? do_raw_spin_lock+0x121/0x260 [ 185.836847] ? rwlock_bug.part.0+0x90/0x90 [ 185.837152] schedule+0xda/0x1b0 [ 185.837397] rescuer_thread+0x851/0xdb0 [ 185.837683] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.838046] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.838398] ? lockdep_hardirqs_on+0x79/0x100 [ 185.838723] ? worker_thread+0x1260/0x1260 [ 185.839055] kthread+0x2ed/0x3a0 [ 185.839303] ? kthread_complete_and_exit+0x40/0x40 [ 185.839647] ret_from_fork+0x22/0x30 [ 185.839941] [ 185.840112] INFO: task kworker/0:0:7 blocked for more than 143 seconds. [ 185.840546] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.840933] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.841445] task:kworker/0:0 state:I stack:29592 pid:7 ppid:2 flags:0x00004000 [ 185.842023] Workqueue: 0x0 (ata_sff) [ 185.842295] Call Trace: [ 185.842476] [ 185.842642] __schedule+0x893/0x2470 [ 185.842945] ? io_schedule_timeout+0x150/0x150 [ 185.843275] schedule+0xda/0x1b0 [ 185.843524] worker_thread+0x15f/0x1260 [ 185.843841] ? process_one_work+0x16a0/0x16a0 [ 185.844163] kthread+0x2ed/0x3a0 [ 185.844407] ? kthread_complete_and_exit+0x40/0x40 [ 185.844753] ret_from_fork+0x22/0x30 [ 185.845140] [ 185.845312] INFO: task kworker/0:0H:8 blocked for more than 143 seconds. [ 185.845768] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.846151] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.846661] task:kworker/0:0H state:I stack:28952 pid:8 ppid:2 flags:0x00004000 [ 185.847245] Workqueue: 0x0 (kblockd) [ 185.847523] Call Trace: [ 185.847710] [ 185.847899] __schedule+0x893/0x2470 [ 185.848176] ? io_schedule_timeout+0x150/0x150 [ 185.848506] schedule+0xda/0x1b0 [ 185.848751] worker_thread+0x15f/0x1260 [ 185.849066] ? process_one_work+0x16a0/0x16a0 [ 185.849390] kthread+0x2ed/0x3a0 [ 185.849635] ? kthread_complete_and_exit+0x40/0x40 [ 185.850002] ret_from_fork+0x22/0x30 [ 185.850282] [ 185.850456] INFO: task mm_percpu_wq:10 blocked for more than 143 seconds. [ 185.850941] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.851307] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.851847] task:mm_percpu_wq state:I stack:30944 pid:10 ppid:2 flags:0x00004000 [ 185.852408] Call Trace: [ 185.852590] [ 185.852758] __schedule+0x893/0x2470 [ 185.853054] ? io_schedule_timeout+0x150/0x150 [ 185.853378] ? do_raw_spin_lock+0x121/0x260 [ 185.853681] ? rwlock_bug.part.0+0x90/0x90 [ 185.854004] schedule+0xda/0x1b0 [ 185.854254] rescuer_thread+0x851/0xdb0 [ 185.854542] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.854921] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.855272] ? lockdep_hardirqs_on+0x79/0x100 [ 185.855591] ? worker_thread+0x1260/0x1260 [ 185.855921] kthread+0x2ed/0x3a0 [ 185.856167] ? kthread_complete_and_exit+0x40/0x40 [ 185.856514] ret_from_fork+0x22/0x30 [ 185.856815] [ 185.856986] INFO: task rcu_tasks_kthre:11 blocked for more than 143 seconds. [ 185.857458] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.857840] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.858349] task:rcu_tasks_kthre state:I stack:29272 pid:11 ppid:2 flags:0x00004000 [ 185.858934] Call Trace: [ 185.859117] [ 185.859288] __schedule+0x893/0x2470 [ 185.859559] ? io_schedule_timeout+0x150/0x150 [ 185.859909] ? mark_held_locks+0x9e/0xe0 [ 185.860205] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.860557] schedule+0xda/0x1b0 [ 185.860828] rcu_tasks_one_gp+0x3db/0xc10 [ 185.861140] rcu_tasks_kthread+0x80/0xa0 [ 185.861425] ? rcu_tasks_postscan+0x10/0x10 [ 185.861728] kthread+0x2ed/0x3a0 [ 185.861998] ? kthread_complete_and_exit+0x40/0x40 [ 185.862344] ret_from_fork+0x22/0x30 [ 185.862621] [ 185.862831] INFO: task kworker/1:0H:21 blocked for more than 143 seconds. [ 185.863283] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.863642] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.864177] task:kworker/1:0H state:I stack:29760 pid:21 ppid:2 flags:0x00004000 [ 185.864739] Workqueue: 0x0 (events_highpri) [ 185.865073] Call Trace: [ 185.865258] [ 185.865425] __schedule+0x893/0x2470 [ 185.865699] ? io_schedule_timeout+0x150/0x150 [ 185.866050] schedule+0xda/0x1b0 [ 185.866302] worker_thread+0x15f/0x1260 [ 185.866596] ? process_one_work+0x16a0/0x16a0 [ 185.866949] kthread+0x2ed/0x3a0 [ 185.867198] ? kthread_complete_and_exit+0x40/0x40 [ 185.867548] ret_from_fork+0x22/0x30 [ 185.867847] [ 185.868018] INFO: task inet_frag_wq:23 blocked for more than 143 seconds. [ 185.868466] Not tainted 6.0.0-rc7-next-20220930 #1 [ 185.868848] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 185.869358] task:inet_frag_wq state:I stack:30704 pid:23 ppid:2 flags:0x00004000 [ 185.869938] Call Trace: [ 185.870125] [ 185.870292] __schedule+0x893/0x2470 [ 185.870563] ? io_schedule_timeout+0x150/0x150 [ 185.870921] ? do_raw_spin_lock+0x121/0x260 [ 185.871230] ? rwlock_bug.part.0+0x90/0x90 [ 185.871547] schedule+0xda/0x1b0 [ 185.871815] rescuer_thread+0x851/0xdb0 [ 185.872103] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.872451] ? _raw_spin_unlock_irqrestore+0x28/0x60 [ 185.872827] ? lockdep_hardirqs_on+0x79/0x100 [ 185.873147] ? worker_thread+0x1260/0x1260 [ 185.873448] kthread+0x2ed/0x3a0 [ 185.873691] ? kthread_complete_and_exit+0x40/0x40 [ 185.874063] ret_from_fork+0x22/0x30 [ 185.874356] [ 185.874589] [ 185.874589] Showing all locks held in the system: [ 185.875047] 1 lock held by rcu_tasks_kthre/11: [ 185.875364] #0: ffffffff85406850 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc10 [ 185.876050] 1 lock held by khungtaskd/25: [ 185.876335] #0: ffffffff85407320 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 [ 185.876979] 1 lock held by systemd-journal/112: [ 185.877299] 1 lock held by in:imklog/211: [ 185.877582] #0: ffff88800d2c19e8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe7/0x100 [ 185.878187] 2 locks held by systemd-udevd/4203: [ 185.878507] [ 185.878635] ============================================= [ 185.878635] VM DIAGNOSIS: 13:45:46 Registers: info registers vcpu 0 RAX=ffff888010145040 RBX=ffff88800f1a7978 RCX=ffffffff8111c29a RDX=0000000000000001 RSI=0000000000000070 RDI=ffff88800f1a78e0 RBP=ffff88800f1a78e0 RSP=ffff88800f1a7870 R8 =0000000000000000 R9 =ffffed1001c35a1c R10=0000000000000001 R11=0000000000000001 R12=0000000000000070 R13=0000000000000000 R14=ffff888010145040 R15=ffff88800f1a78e0 RIP=ffffffff81787f1b RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007fd5cbd2e900 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fd5cb2066c8 CR3=000000000f1d0000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff YMM01=0000000000000000 0000000000000000 3030623438613630 3638616663356134 YMM02=0000000000000000 0000000000000000 3830306234386136 3036386166633561 YMM03=0000000000000000 0000000000000000 2f6c616e72756f6a 2f676f6c2f6e7572 YMM04=0000000000000000 0000000000000000 d65a6001d2001b43 0000000000136698 YMM05=0000000000000000 0000000000000000 d3fdd5f48436fbd7 00000000000aead0 YMM06=0000000000000000 0000000000000000 951a1770b214620c 00000000000ae988 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 44495f474f4c5359 530069253d595449 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0020002000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9 RSI=ffffffff823bb06c RDI=ffffffff8765a9a0 RBP=ffffffff8765a960 RSP=ffff88800902f8a0 R8 =0000000000000001 R9 =ffff88800902f82b R10=ffffed1001205f05 R11=0000000000000001 R12=000000000000002e R13=ffffffff8765a960 R14=ffffffff8765a9b0 R15=ffffffff8765ac10 RIP=ffffffff823bb0c1 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fc89a54fc70 CR3=0000000009cca000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 000000000000002f 002f2e2e2f002e2e YMM01=0000000000000000 0000000000000000 0000000000000000 696c61766e49002f YMM02=0000000000000000 0000000000000000 ffffffffffffff0f 0e0d0c0b0a090807 YMM03=0000000000000000 0000000000000000 696e656420737365 636341002f737973 YMM04=0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000101 YMM06=0000000000000000 0000000000000000 00005568ea3e08a0 00005568ea3d0160 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 610064253a64252f 6b636f6c622f7665 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000200000 0000000000200000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000