Warning: Permanently added '[localhost]:39596' (ECDSA) to the list of known hosts. 2022/10/31 11:29:35 fuzzer started 2022/10/31 11:29:36 dialing manager at localhost:40945 syzkaller login: [ 35.784982] cgroup: Unknown subsys name 'net' [ 35.869511] cgroup: Unknown subsys name 'rlimit' 2022/10/31 11:29:49 syscalls: 2217 2022/10/31 11:29:49 code coverage: enabled 2022/10/31 11:29:49 comparison tracing: enabled 2022/10/31 11:29:49 extra coverage: enabled 2022/10/31 11:29:49 setuid sandbox: enabled 2022/10/31 11:29:49 namespace sandbox: enabled 2022/10/31 11:29:49 Android sandbox: enabled 2022/10/31 11:29:49 fault injection: enabled 2022/10/31 11:29:49 leak checking: enabled 2022/10/31 11:29:49 net packet injection: enabled 2022/10/31 11:29:49 net device setup: enabled 2022/10/31 11:29:49 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/10/31 11:29:49 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/10/31 11:29:49 USB emulation: enabled 2022/10/31 11:29:49 hci packet injection: enabled 2022/10/31 11:29:49 wifi device emulation: enabled 2022/10/31 11:29:49 802.15.4 emulation: enabled 2022/10/31 11:29:49 fetching corpus: 0, signal 0/2000 (executing program) 2022/10/31 11:29:49 fetching corpus: 50, signal 30748/34179 (executing program) 2022/10/31 11:29:49 fetching corpus: 100, signal 43261/48060 (executing program) 2022/10/31 11:29:49 fetching corpus: 150, signal 50839/56900 (executing program) 2022/10/31 11:29:49 fetching corpus: 200, signal 60241/67387 (executing program) 2022/10/31 11:29:49 fetching corpus: 250, signal 67505/75626 (executing program) 2022/10/31 11:29:50 fetching corpus: 300, signal 72175/81372 (executing program) 2022/10/31 11:29:50 fetching corpus: 350, signal 77893/87917 (executing program) 2022/10/31 11:29:50 fetching corpus: 400, signal 82675/93511 (executing program) 2022/10/31 11:29:50 fetching corpus: 450, signal 86725/98364 (executing program) 2022/10/31 11:29:50 fetching corpus: 500, signal 90376/102735 (executing program) 2022/10/31 11:29:50 fetching corpus: 550, signal 93775/106895 (executing program) 2022/10/31 11:29:50 fetching corpus: 600, signal 97025/110838 (executing program) 2022/10/31 11:29:51 fetching corpus: 650, signal 99008/113610 (executing program) 2022/10/31 11:29:51 fetching corpus: 700, signal 102318/117447 (executing program) 2022/10/31 11:29:51 fetching corpus: 750, signal 104148/119989 (executing program) 2022/10/31 11:29:51 fetching corpus: 800, signal 107250/123527 (executing program) 2022/10/31 11:29:51 fetching corpus: 850, signal 111511/128002 (executing program) 2022/10/31 11:29:51 fetching corpus: 900, signal 114345/131235 (executing program) 2022/10/31 11:29:51 fetching corpus: 950, signal 115773/133295 (executing program) 2022/10/31 11:29:52 fetching corpus: 1000, signal 117915/135895 (executing program) 2022/10/31 11:29:52 fetching corpus: 1050, signal 119691/138138 (executing program) 2022/10/31 11:29:52 fetching corpus: 1100, signal 121196/140176 (executing program) 2022/10/31 11:29:52 fetching corpus: 1150, signal 123475/142784 (executing program) 2022/10/31 11:29:52 fetching corpus: 1200, signal 125746/145307 (executing program) 2022/10/31 11:29:52 fetching corpus: 1250, signal 128150/147976 (executing program) 2022/10/31 11:29:53 fetching corpus: 1300, signal 129666/149886 (executing program) 2022/10/31 11:29:53 fetching corpus: 1350, signal 131234/151748 (executing program) 2022/10/31 11:29:53 fetching corpus: 1400, signal 132734/153607 (executing program) 2022/10/31 11:29:53 fetching corpus: 1450, signal 135101/155989 (executing program) 2022/10/31 11:29:54 fetching corpus: 1500, signal 136327/157560 (executing program) 2022/10/31 11:29:54 fetching corpus: 1550, signal 137738/159276 (executing program) 2022/10/31 11:29:54 fetching corpus: 1600, signal 138681/160563 (executing program) 2022/10/31 11:29:54 fetching corpus: 1650, signal 139856/162032 (executing program) 2022/10/31 11:29:54 fetching corpus: 1700, signal 141112/163552 (executing program) 2022/10/31 11:29:54 fetching corpus: 1750, signal 142138/164844 (executing program) 2022/10/31 11:29:54 fetching corpus: 1800, signal 143475/166391 (executing program) 2022/10/31 11:29:54 fetching corpus: 1850, signal 145409/168269 (executing program) 2022/10/31 11:29:54 fetching corpus: 1900, signal 146500/169562 (executing program) 2022/10/31 11:29:55 fetching corpus: 1950, signal 147730/170918 (executing program) 2022/10/31 11:29:55 fetching corpus: 2000, signal 149168/172338 (executing program) 2022/10/31 11:29:55 fetching corpus: 2050, signal 150144/173474 (executing program) 2022/10/31 11:29:55 fetching corpus: 2100, signal 151599/174905 (executing program) 2022/10/31 11:29:55 fetching corpus: 2150, signal 153128/176361 (executing program) 2022/10/31 11:29:55 fetching corpus: 2200, signal 154178/177501 (executing program) 2022/10/31 11:29:55 fetching corpus: 2250, signal 155427/178752 (executing program) 2022/10/31 11:29:55 fetching corpus: 2300, signal 156712/179901 (executing program) 2022/10/31 11:29:56 fetching corpus: 2350, signal 157938/181076 (executing program) 2022/10/31 11:29:56 fetching corpus: 2400, signal 158818/182010 (executing program) 2022/10/31 11:29:56 fetching corpus: 2450, signal 159744/182968 (executing program) 2022/10/31 11:29:56 fetching corpus: 2500, signal 161057/184162 (executing program) 2022/10/31 11:29:56 fetching corpus: 2550, signal 161853/185076 (executing program) 2022/10/31 11:29:56 fetching corpus: 2600, signal 162546/185894 (executing program) 2022/10/31 11:29:56 fetching corpus: 2650, signal 164347/187187 (executing program) 2022/10/31 11:29:56 fetching corpus: 2700, signal 165298/188057 (executing program) 2022/10/31 11:29:57 fetching corpus: 2750, signal 166078/188818 (executing program) 2022/10/31 11:29:57 fetching corpus: 2800, signal 167126/189684 (executing program) 2022/10/31 11:29:57 fetching corpus: 2850, signal 168625/190778 (executing program) 2022/10/31 11:29:57 fetching corpus: 2900, signal 169605/191588 (executing program) 2022/10/31 11:29:57 fetching corpus: 2950, signal 171018/192566 (executing program) 2022/10/31 11:29:57 fetching corpus: 3000, signal 172090/193372 (executing program) 2022/10/31 11:29:58 fetching corpus: 3050, signal 172715/193995 (executing program) 2022/10/31 11:29:58 fetching corpus: 3100, signal 173718/194729 (executing program) 2022/10/31 11:29:58 fetching corpus: 3150, signal 174850/195443 (executing program) 2022/10/31 11:29:58 fetching corpus: 3200, signal 175872/196108 (executing program) 2022/10/31 11:29:58 fetching corpus: 3250, signal 177563/197051 (executing program) 2022/10/31 11:29:58 fetching corpus: 3300, signal 178320/197618 (executing program) 2022/10/31 11:29:58 fetching corpus: 3350, signal 178840/198118 (executing program) 2022/10/31 11:29:58 fetching corpus: 3400, signal 179460/198594 (executing program) 2022/10/31 11:29:58 fetching corpus: 3450, signal 180269/199154 (executing program) 2022/10/31 11:29:59 fetching corpus: 3500, signal 181185/199733 (executing program) 2022/10/31 11:29:59 fetching corpus: 3550, signal 182389/200337 (executing program) 2022/10/31 11:29:59 fetching corpus: 3600, signal 184203/201075 (executing program) 2022/10/31 11:29:59 fetching corpus: 3650, signal 185069/201516 (executing program) 2022/10/31 11:29:59 fetching corpus: 3700, signal 186125/202014 (executing program) 2022/10/31 11:29:59 fetching corpus: 3750, signal 187264/202526 (executing program) 2022/10/31 11:29:59 fetching corpus: 3800, signal 187983/202921 (executing program) 2022/10/31 11:29:59 fetching corpus: 3850, signal 188578/203258 (executing program) 2022/10/31 11:29:59 fetching corpus: 3900, signal 188991/203520 (executing program) 2022/10/31 11:30:00 fetching corpus: 3950, signal 189614/203843 (executing program) 2022/10/31 11:30:00 fetching corpus: 4000, signal 190364/204169 (executing program) 2022/10/31 11:30:00 fetching corpus: 4050, signal 191284/204521 (executing program) 2022/10/31 11:30:00 fetching corpus: 4100, signal 192155/204876 (executing program) 2022/10/31 11:30:00 fetching corpus: 4150, signal 194399/205420 (executing program) 2022/10/31 11:30:00 fetching corpus: 4200, signal 194804/205633 (executing program) 2022/10/31 11:30:00 fetching corpus: 4250, signal 195268/205841 (executing program) 2022/10/31 11:30:01 fetching corpus: 4300, signal 196032/206061 (executing program) 2022/10/31 11:30:01 fetching corpus: 4350, signal 196579/206253 (executing program) 2022/10/31 11:30:01 fetching corpus: 4400, signal 197089/206430 (executing program) 2022/10/31 11:30:01 fetching corpus: 4450, signal 197648/206585 (executing program) 2022/10/31 11:30:01 fetching corpus: 4500, signal 198238/206757 (executing program) 2022/10/31 11:30:01 fetching corpus: 4550, signal 198642/206898 (executing program) 2022/10/31 11:30:01 fetching corpus: 4600, signal 199326/207059 (executing program) 2022/10/31 11:30:01 fetching corpus: 4650, signal 199654/207183 (executing program) 2022/10/31 11:30:01 fetching corpus: 4700, signal 200548/207317 (executing program) 2022/10/31 11:30:02 fetching corpus: 4750, signal 201479/207619 (executing program) 2022/10/31 11:30:02 fetching corpus: 4800, signal 201994/207728 (executing program) 2022/10/31 11:30:02 fetching corpus: 4850, signal 202522/207814 (executing program) 2022/10/31 11:30:02 fetching corpus: 4900, signal 203214/208115 (executing program) 2022/10/31 11:30:02 fetching corpus: 4938, signal 203810/208183 (executing program) 2022/10/31 11:30:02 fetching corpus: 4938, signal 203810/208217 (executing program) 2022/10/31 11:30:02 fetching corpus: 4938, signal 203810/208250 (executing program) 2022/10/31 11:30:02 fetching corpus: 4938, signal 203810/208299 (executing program) 2022/10/31 11:30:02 fetching corpus: 4938, signal 203810/208303 (executing program) 2022/10/31 11:30:02 fetching corpus: 4938, signal 203810/208303 (executing program) 2022/10/31 11:30:05 starting 8 fuzzer processes 11:30:05 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x4a, 0x0, &(0x7f0000000000)) 11:30:05 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) 11:30:05 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x2a, 0x0, 0x0) 11:30:05 executing program 3: futex(0x0, 0x80, 0x0, &(0x7f00000001c0), 0x0, 0x0) [ 64.400974] audit: type=1400 audit(1667215805.094:6): avc: denied { execmem } for pid=283 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 11:30:05 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 11:30:05 executing program 5: io_setup(0x6, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x105241, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000000c0)={0x8}) io_submit(r0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) 11:30:05 executing program 6: perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xfffffffffffffffa}, 0x240, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) 11:30:05 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) [ 65.850874] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 65.851639] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 65.852805] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 65.854858] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 65.856678] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 65.857149] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 65.859431] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 65.859913] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 65.860720] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 65.863632] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 65.865955] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 65.867594] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 65.869932] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 65.870287] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 65.872421] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 65.873792] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 65.874115] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 65.876220] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 65.879155] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 65.880544] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 65.882560] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 65.884035] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 65.885709] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 65.896143] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 65.897985] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 65.899278] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 65.900922] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 65.902622] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 65.903393] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 65.905907] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 65.907045] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 65.907464] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 65.909369] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 65.910656] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 65.912017] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 65.914231] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 65.915685] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 65.917002] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 65.919702] Bluetooth: hci7: HCI_REQ-0x0c1a [ 65.921628] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 65.936523] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 65.937775] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 65.943054] Bluetooth: hci1: HCI_REQ-0x0c1a [ 65.944473] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 65.944476] Bluetooth: hci3: HCI_REQ-0x0c1a [ 65.945756] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 65.947794] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 65.954556] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 65.960663] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 65.981229] Bluetooth: hci0: HCI_REQ-0x0c1a [ 65.983546] Bluetooth: hci6: HCI_REQ-0x0c1a [ 65.984707] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 65.991693] Bluetooth: hci2: HCI_REQ-0x0c1a [ 65.995557] Bluetooth: hci4: HCI_REQ-0x0c1a [ 66.026993] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 66.034647] Bluetooth: hci5: HCI_REQ-0x0c1a [ 67.948811] Bluetooth: hci7: command 0x0409 tx timeout [ 68.012798] Bluetooth: hci6: command 0x0409 tx timeout [ 68.013404] Bluetooth: hci1: command 0x0409 tx timeout [ 68.013875] Bluetooth: hci3: command 0x0409 tx timeout [ 68.077523] Bluetooth: hci5: command 0x0409 tx timeout [ 68.078202] Bluetooth: hci2: command 0x0409 tx timeout [ 68.078724] Bluetooth: hci0: command 0x0409 tx timeout [ 68.079210] Bluetooth: hci4: command 0x0409 tx timeout [ 69.997368] Bluetooth: hci7: command 0x041b tx timeout [ 70.061444] Bluetooth: hci3: command 0x041b tx timeout [ 70.061882] Bluetooth: hci1: command 0x041b tx timeout [ 70.062269] Bluetooth: hci6: command 0x041b tx timeout [ 70.124440] Bluetooth: hci4: command 0x041b tx timeout [ 70.124898] Bluetooth: hci0: command 0x041b tx timeout [ 70.125275] Bluetooth: hci2: command 0x041b tx timeout [ 70.125688] Bluetooth: hci5: command 0x041b tx timeout [ 72.044374] Bluetooth: hci7: command 0x040f tx timeout [ 72.109398] Bluetooth: hci6: command 0x040f tx timeout [ 72.109854] Bluetooth: hci1: command 0x040f tx timeout [ 72.110241] Bluetooth: hci3: command 0x040f tx timeout [ 72.172395] Bluetooth: hci5: command 0x040f tx timeout [ 72.172871] Bluetooth: hci2: command 0x040f tx timeout [ 72.173711] Bluetooth: hci0: command 0x040f tx timeout [ 72.174095] Bluetooth: hci4: command 0x040f tx timeout [ 74.093410] Bluetooth: hci7: command 0x0419 tx timeout [ 74.156389] Bluetooth: hci3: command 0x0419 tx timeout [ 74.156973] Bluetooth: hci1: command 0x0419 tx timeout [ 74.157466] Bluetooth: hci6: command 0x0419 tx timeout [ 74.220461] Bluetooth: hci4: command 0x0419 tx timeout [ 74.221014] Bluetooth: hci0: command 0x0419 tx timeout [ 74.221502] Bluetooth: hci2: command 0x0419 tx timeout [ 74.221933] Bluetooth: hci5: command 0x0419 tx timeout [ 120.633528] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.634259] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.635965] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 120.693609] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.694306] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.695833] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 120.832295] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.833000] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.834403] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 120.860700] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.861430] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.862797] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 120.910479] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.910855] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.911201] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.912377] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.914670] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 120.916283] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 120.979485] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.980200] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.981882] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 121.044882] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.045555] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.046775] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 121.069196] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.069831] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.079521] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 121.081241] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.081764] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.083704] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 121.186654] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.187214] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.188370] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 121.215634] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.216185] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.218251] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 121.385848] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.386432] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.456896] audit: type=1400 audit(1667215862.149:7): avc: denied { open } for pid=3896 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 121.458381] audit: type=1400 audit(1667215862.149:8): avc: denied { kernel } for pid=3896 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 121.493382] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 121.505343] hrtimer: interrupt took 29635 ns [ 121.509781] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.510288] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.512233] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready 11:31:02 executing program 5: io_setup(0x6, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x105241, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000000c0)={0x8}) io_submit(r0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) [ 121.546636] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.547153] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.551354] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 11:31:02 executing program 6: perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xfffffffffffffffa}, 0x240, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) 11:31:02 executing program 5: io_setup(0x6, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x105241, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000000c0)={0x8}) io_submit(r0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) [ 121.835644] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.836829] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.839348] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 11:31:02 executing program 5: io_setup(0x6, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x105241, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000000c0)={0x8}) io_submit(r0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) 11:31:02 executing program 5: io_setup(0x6, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x105241, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000000c0)={0x8}) io_submit(r0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) 11:31:03 executing program 5: io_setup(0x6, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x105241, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000000c0)={0x8}) io_submit(r0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) 11:31:03 executing program 6: perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xfffffffffffffffa}, 0x240, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) 11:31:03 executing program 5: io_setup(0x6, &(0x7f0000000040)=0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x105241, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000000c0)={0x8}) io_submit(r0, 0x1, &(0x7f00000004c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0}]) 11:31:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x4a, 0x0, &(0x7f0000000000)) 11:31:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x2a, 0x0, 0x0) 11:31:04 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 11:31:04 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) 11:31:04 executing program 5: r0 = epoll_create(0x4) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000200), 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000240)) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0) 11:31:04 executing program 3: futex(0x0, 0x80, 0x0, &(0x7f00000001c0), 0x0, 0x0) 11:31:04 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 11:31:04 executing program 6: perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0xfffffffffffffffa}, 0x240, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone3(&(0x7f00000001c0)={0x123363500, &(0x7f0000000180), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) 11:31:04 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 11:31:04 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) 11:31:04 executing program 5: r0 = epoll_create(0x4) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000200), 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000240)) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0) 11:31:04 executing program 3: futex(0x0, 0x80, 0x0, &(0x7f00000001c0), 0x0, 0x0) 11:31:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x4a, 0x0, &(0x7f0000000000)) 11:31:04 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 11:31:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x2a, 0x0, 0x0) 11:31:04 executing program 3: futex(0x0, 0x80, 0x0, &(0x7f00000001c0), 0x0, 0x0) 11:31:04 executing program 5: r0 = epoll_create(0x4) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000200), 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000240)) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0) 11:31:04 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 11:31:04 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) 11:31:04 executing program 5: r0 = epoll_create(0x4) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000200), 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000240)) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0) 11:31:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x4a, 0x0, &(0x7f0000000000)) 11:31:04 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 11:31:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x2a, 0x0, 0x0) 11:31:04 executing program 6: r0 = epoll_create(0x4) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000200), 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000240)) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0) 11:31:04 executing program 3: r0 = syz_open_dev$rtc(&(0x7f00000007c0), 0x0, 0x0) ioctl$RTC_ALM_SET(r0, 0x40187014, &(0x7f0000000000)={0x0, 0xfffffffe}) 11:31:04 executing program 4: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:04 executing program 6: r0 = epoll_create(0x4) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000200), 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000240)) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0) 11:31:04 executing program 3: r0 = syz_open_dev$rtc(&(0x7f00000007c0), 0x0, 0x0) ioctl$RTC_ALM_SET(r0, 0x40187014, &(0x7f0000000000)={0x0, 0xfffffffe}) 11:31:04 executing program 1: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'}) [ 124.127385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.132648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 11:31:04 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000380)={r0}) r1 = open(0x0, 0x0, 0xb) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001800), 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) write(r2, &(0x7f0000000080)="01", 0x292e9) 11:31:04 executing program 6: r0 = epoll_create(0x4) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000200), 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000240)) syz_mount_image$vfat(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0) 11:31:04 executing program 3: r0 = syz_open_dev$rtc(&(0x7f00000007c0), 0x0, 0x0) ioctl$RTC_ALM_SET(r0, 0x40187014, &(0x7f0000000000)={0x0, 0xfffffffe}) 11:31:04 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_SIOCINQ(r0, 0x89e0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) 11:31:04 executing program 7: msgrcv(0x0, 0x0, 0x70, 0x3, 0x3000) msgsnd(0x0, &(0x7f0000002440)={0x2}, 0x8, 0x0) 11:31:04 executing program 5: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) [ 124.557085] BUG: unable to handle page fault for address: ffffed100fffc000 [ 124.557664] #PF: supervisor write access in kernel mode [ 124.558046] #PF: error_code(0x0002) - not-present page [ 124.558418] PGD 7ffd3067 P4D 7ffd3067 PUD 7ffd2067 PMD 7ffd1067 PTE 0 [ 124.558901] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 124.560031] CPU: 1 PID: 4029 Comm: syz-executor.4 Not tainted 6.1.0-rc3-next-20221031 #1 [ 124.562279] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 124.564029] RIP: 0010:__memset+0x24/0x50 [ 124.564349] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 124.565636] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 124.566035] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 124.566748] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 124.567472] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 124.568194] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 124.568914] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 124.569662] FS: 00007f255ae04700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 124.570471] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 124.571062] CR2: ffffed100fffc000 CR3: 000000003dd66000 CR4: 0000000000350ee0 [ 124.571782] Call Trace: [ 124.572051] [ 124.572292] kasan_unpoison+0x23/0x60 [ 124.572696] mempool_exit+0x1c2/0x330 [ 124.573112] bioset_exit+0x2c9/0x630 [ 124.573523] disk_release+0x143/0x490 [ 124.573932] ? disk_release+0x0/0x490 [ 124.574334] ? device_release+0x0/0x250 [ 124.574747] device_release+0xa2/0x250 [ 124.575156] ? device_release+0x0/0x250 [ 124.575569] kobject_put+0x173/0x280 [ 124.575961] put_device+0x1b/0x40 [ 124.576329] put_disk+0x41/0x60 [ 124.576680] loop_control_ioctl+0x4d1/0x630 [ 124.577171] ? loop_control_ioctl+0x0/0x630 [ 124.577677] ? selinux_file_ioctl+0xb1/0x270 [ 124.578121] ? loop_control_ioctl+0x0/0x630 [ 124.578469] __x64_sys_ioctl+0x19a/0x220 [ 124.578785] do_syscall_64+0x3b/0xa0 [ 124.579083] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 124.579469] RIP: 0033:0x7f255d88eb19 [ 124.579739] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 124.580993] RSP: 002b:00007f255ae04188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 124.581516] RAX: ffffffffffffffda RBX: 00007f255d9a1f60 RCX: 00007f255d88eb19 [ 124.581993] RDX: 0000000000000000 RSI: 0000000000004c81 RDI: 0000000000000005 [ 124.582470] RBP: 00007f255d8e8f6d R08: 0000000000000000 R09: 0000000000000000 [ 124.582952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.583437] R13: 00007ffde51fea4f R14: 00007f255ae04300 R15: 0000000000022000 [ 124.583925] [ 124.584090] Modules linked in: [ 124.584318] CR2: ffffed100fffc000 [ 124.584557] ---[ end trace 0000000000000000 ]--- [ 124.584878] RIP: 0010:__memset+0x24/0x50 [ 124.585175] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 124.586400] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 124.586766] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 124.587253] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 124.587735] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 124.588217] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 124.588704] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 124.589201] FS: 00007f255ae04700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 124.589782] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 124.590191] CR2: ffffed100fffc000 CR3: 000000003dd66000 CR4: 0000000000350ee0 [ 124.654251] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.655767] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.990582] BUG: unable to handle page fault for address: ffffed100fffc000 [ 124.991086] #PF: supervisor write access in kernel mode [ 124.991425] #PF: error_code(0x0002) - not-present page [ 124.991756] PGD 7ffd3067 P4D 7ffd3067 PUD 7ffd2067 PMD 7ffd1067 PTE 0 [ 124.992185] Oops: 0002 [#2] PREEMPT SMP KASAN NOPTI [ 124.992512] CPU: 1 PID: 4036 Comm: syz-executor.4 Tainted: G D 6.1.0-rc3-next-20221031 #1 [ 124.993112] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 124.993643] RIP: 0010:__memset+0x24/0x50 [ 124.993929] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 124.995080] RSP: 0018:ffff8880402b7cc0 EFLAGS: 00010216 [ 124.995426] RAX: 0000000000000000 RBX: ffff88800bf4e240 RCX: 1ffffe21fe5fb700 [ 124.995882] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 124.996340] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c48 [ 124.996794] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 124.997241] R13: ffff88800bf4e240 R14: ffffffff815f27a0 R15: 1ffff1100112501f [ 124.997719] FS: 00007f255ade3700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 124.998229] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 124.998602] CR2: ffffed100fffc000 CR3: 000000003dd66000 CR4: 0000000000350ee0 [ 124.999060] Call Trace: [ 124.999228] [ 124.999377] kasan_unpoison+0x23/0x60 [ 124.999629] mempool_exit+0x1c2/0x330 [ 124.999891] bioset_exit+0x2c9/0x630 [ 125.000146] disk_release+0x143/0x490 [ 125.000403] ? disk_release+0x0/0x490 [ 125.000657] ? device_release+0x0/0x250 [ 125.000914] device_release+0xa2/0x250 [ 125.001167] ? device_release+0x0/0x250 [ 125.001428] kobject_put+0x173/0x280 [ 125.001678] put_device+0x1b/0x40 [ 125.001910] put_disk+0x41/0x60 [ 125.002137] loop_control_ioctl+0x4d1/0x630 [ 125.002426] ? loop_control_ioctl+0x0/0x630 [ 125.002707] ? selinux_file_ioctl+0xb1/0x270 [ 125.003002] ? loop_control_ioctl+0x0/0x630 [ 125.003283] __x64_sys_ioctl+0x19a/0x220 [ 125.003557] do_syscall_64+0x3b/0xa0 [ 125.003812] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 125.004151] RIP: 0033:0x7f255d88eb19 [ 125.004397] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 125.005525] RSP: 002b:00007f255ade3188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 125.006022] RAX: ffffffffffffffda RBX: 00007f255d9a2020 RCX: 00007f255d88eb19 [ 125.006492] RDX: 0000000000000001 RSI: 0000000000004c81 RDI: 0000000000000005 [ 125.006947] RBP: 00007f255d8e8f6d R08: 0000000000000000 R09: 0000000000000000 [ 125.007392] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.007856] R13: 00007ffde51fea4f R14: 00007f255ade3300 R15: 0000000000022000 [ 125.008326] [ 125.008489] Modules linked in: [ 125.008706] CR2: ffffed100fffc000 [ 125.008929] ---[ end trace 0000000000000000 ]--- [ 125.009223] RIP: 0010:__memset+0x24/0x50 [ 125.009509] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 125.010666] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 125.011016] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 125.011476] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 125.011924] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 125.012368] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 125.012833] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 125.013298] FS: 00007f255ade3700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 125.013820] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.014191] CR2: ffffed100fffc000 CR3: 000000003dd66000 CR4: 0000000000350ee0 11:31:05 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_SIOCINQ(r0, 0x89e0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) 11:31:05 executing program 6: setitimer(0x1, &(0x7f0000000140)={{}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f00000000c0)) 11:31:05 executing program 3: r0 = syz_open_dev$rtc(&(0x7f00000007c0), 0x0, 0x0) ioctl$RTC_ALM_SET(r0, 0x40187014, &(0x7f0000000000)={0x0, 0xfffffffe}) 11:31:05 executing program 7: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:05 executing program 4: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:05 executing program 5: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) 11:31:05 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000380)={r0}) r1 = open(0x0, 0x0, 0xb) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001800), 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) write(r2, &(0x7f0000000080)="01", 0x292e9) 11:31:05 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000380)={r0}) r1 = open(0x0, 0x0, 0xb) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001800), 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) write(r2, &(0x7f0000000080)="01", 0x292e9) 11:31:05 executing program 3: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_SIOCINQ(r0, 0x89e0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) 11:31:05 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_SIOCINQ(r0, 0x89e0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) [ 125.305156] audit: type=1400 audit(1667215865.972:9): avc: denied { write } for pid=4075 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 11:31:06 executing program 6: setitimer(0x1, &(0x7f0000000140)={{}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f00000000c0)) 11:31:06 executing program 3: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_SIOCINQ(r0, 0x89e0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) [ 125.477881] BUG: unable to handle page fault for address: ffffed100fffc000 [ 125.478544] #PF: supervisor write access in kernel mode [ 125.478974] #PF: error_code(0x0002) - not-present page [ 125.479324] PGD 7ffd3067 P4D 7ffd3067 PUD 7ffd2067 PMD 7ffd1067 PTE 0 [ 125.479794] Oops: 0002 [#3] PREEMPT SMP KASAN NOPTI [ 125.480137] CPU: 1 PID: 4067 Comm: syz-executor.4 Tainted: G D 6.1.0-rc3-next-20221031 #1 [ 125.480782] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 125.481348] RIP: 0010:__memset+0x24/0x50 [ 125.481652] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 125.482859] RSP: 0018:ffff888040827cc0 EFLAGS: 00010216 [ 125.483224] RAX: 0000000000000000 RBX: ffff88800bf4e3c0 RCX: 1ffffe21fe5fb706 [ 125.483705] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 125.484190] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c78 [ 125.484675] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 125.485161] R13: ffff88800bf4e3c0 R14: ffffffff815f27a0 R15: 1ffff11001195c1f [ 125.485646] FS: 00007f255ae04700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 125.486176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.486559] CR2: ffffed100fffc000 CR3: 000000000c062000 CR4: 0000000000350ee0 [ 125.487029] Call Trace: [ 125.487204] [ 125.487357] kasan_unpoison+0x23/0x60 [ 125.487617] mempool_exit+0x1c2/0x330 [ 125.487885] bioset_exit+0x2c9/0x630 [ 125.488146] disk_release+0x143/0x490 [ 125.488405] ? disk_release+0x0/0x490 [ 125.488664] ? device_release+0x0/0x250 [ 125.488942] device_release+0xa2/0x250 [ 125.489204] ? device_release+0x0/0x250 [ 125.489487] kobject_put+0x173/0x280 [ 125.489743] put_device+0x1b/0x40 [ 125.489980] put_disk+0x41/0x60 [ 125.490210] loop_control_ioctl+0x4d1/0x630 [ 125.490507] ? loop_control_ioctl+0x0/0x630 [ 125.490798] ? selinux_file_ioctl+0xb1/0x270 [ 125.491108] ? loop_control_ioctl+0x0/0x630 [ 125.491402] __x64_sys_ioctl+0x19a/0x220 [ 125.491691] do_syscall_64+0x3b/0xa0 [ 125.491950] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 125.492296] RIP: 0033:0x7f255d88eb19 [ 125.492550] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 125.493726] RSP: 002b:00007f255ae04188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 125.494219] RAX: ffffffffffffffda RBX: 00007f255d9a1f60 RCX: 00007f255d88eb19 [ 125.494680] RDX: 0000000000000002 RSI: 0000000000004c81 RDI: 0000000000000005 [ 125.495151] RBP: 00007f255d8e8f6d R08: 0000000000000000 R09: 0000000000000000 [ 125.495619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.496082] R13: 00007ffde51fea4f R14: 00007f255ae04300 R15: 0000000000022000 [ 125.496555] [ 125.496715] Modules linked in: [ 125.496931] CR2: ffffed100fffc000 [ 125.497164] ---[ end trace 0000000000000000 ]--- [ 125.497478] RIP: 0010:__memset+0x24/0x50 [ 125.497759] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 125.498912] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 125.499261] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 125.499724] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 125.500187] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 125.500652] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 125.501115] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 125.501592] FS: 00007f255ae04700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 125.502120] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 125.502496] CR2: ffffed100fffc000 CR3: 000000000c062000 CR4: 0000000000350ee0 11:31:06 executing program 6: setitimer(0x1, &(0x7f0000000140)={{}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f00000000c0)) 11:31:06 executing program 5: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) 11:31:06 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_SIOCINQ(r0, 0x89e0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) 11:31:06 executing program 3: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_SIOCINQ(r0, 0x89e0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) 11:31:06 executing program 6: setitimer(0x1, &(0x7f0000000140)={{}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f00000000c0)) 11:31:06 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000380)={r0}) r1 = open(0x0, 0x0, 0xb) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001800), 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) write(r2, &(0x7f0000000080)="01", 0x292e9) 11:31:06 executing program 2: setitimer(0x1, &(0x7f0000000140)={{}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f00000000c0)) 11:31:06 executing program 7: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:06 executing program 3: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:06 executing program 5: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) 11:31:06 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000380)={r0}) r1 = open(0x0, 0x0, 0xb) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001800), 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) write(r2, &(0x7f0000000080)="01", 0x292e9) 11:31:06 executing program 4: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:06 executing program 2: setitimer(0x1, &(0x7f0000000140)={{}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f00000000c0)) 11:31:06 executing program 6: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 126.241129] BUG: unable to handle page fault for address: ffffed100fffc000 [ 126.241640] #PF: supervisor write access in kernel mode [ 126.241984] #PF: error_code(0x0002) - not-present page [ 126.242328] PGD 7ffd3067 P4D 7ffd3067 PUD 7ffd2067 PMD 7ffd1067 PTE 0 [ 126.242776] Oops: 0002 [#4] PREEMPT SMP KASAN NOPTI [ 126.243107] CPU: 1 PID: 4120 Comm: syz-executor.4 Tainted: G D 6.1.0-rc3-next-20221031 #1 [ 126.243732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 126.244276] RIP: 0010:__memset+0x24/0x50 [ 126.244568] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 126.245804] RSP: 0018:ffff88800b77fcc0 EFLAGS: 00010216 [ 126.246172] RAX: 0000000000000000 RBX: ffff88800bf4e540 RCX: 1ffffe21fe5fb70c [ 126.246661] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 126.247155] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9ca8 [ 126.247607] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 126.248052] R13: ffff88800bf4e540 R14: ffffffff815f27a0 R15: 1ffff1100119581f [ 126.248503] FS: 00007f255ae04700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 126.249009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.249392] CR2: ffffed100fffc000 CR3: 000000001502e000 CR4: 0000000000350ee0 [ 126.249843] Call Trace: [ 126.250012] [ 126.250161] kasan_unpoison+0x23/0x60 [ 126.250416] mempool_exit+0x1c2/0x330 [ 126.250682] bioset_exit+0x2c9/0x630 [ 126.250945] disk_release+0x143/0x490 [ 126.251211] ? disk_release+0x0/0x490 [ 126.251475] ? device_release+0x0/0x250 [ 126.251746] device_release+0xa2/0x250 [ 126.252001] ? device_release+0x0/0x250 [ 126.252259] kobject_put+0x173/0x280 [ 126.252510] put_device+0x1b/0x40 [ 126.252741] put_disk+0x41/0x60 [ 126.252970] loop_control_ioctl+0x4d1/0x630 [ 126.253268] ? loop_control_ioctl+0x0/0x630 [ 126.253571] ? selinux_file_ioctl+0xb1/0x270 [ 126.253881] ? loop_control_ioctl+0x0/0x630 [ 126.254181] __x64_sys_ioctl+0x19a/0x220 [ 126.254467] do_syscall_64+0x3b/0xa0 [ 126.254730] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 126.255080] RIP: 0033:0x7f255d88eb19 [ 126.255332] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 126.256509] RSP: 002b:00007f255ae04188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 126.257009] RAX: ffffffffffffffda RBX: 00007f255d9a1f60 RCX: 00007f255d88eb19 [ 126.257493] RDX: 0000000000000003 RSI: 0000000000004c81 RDI: 0000000000000005 [ 126.257963] RBP: 00007f255d8e8f6d R08: 0000000000000000 R09: 0000000000000000 [ 126.258430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.258896] R13: 00007ffde51fea4f R14: 00007f255ae04300 R15: 0000000000022000 [ 126.259372] [ 126.259532] Modules linked in: [ 126.259753] CR2: ffffed100fffc000 [ 126.259985] ---[ end trace 0000000000000000 ]--- [ 126.260297] RIP: 0010:__memset+0x24/0x50 [ 126.260586] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 126.261771] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 126.262124] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 126.262588] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 126.263057] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 126.263526] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 126.263992] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 126.264461] FS: 00007f255ae04700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 126.264980] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.265353] CR2: ffffed100fffc000 CR3: 000000001502e000 CR4: 0000000000350ee0 11:31:07 executing program 2: setitimer(0x1, &(0x7f0000000140)={{}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f00000000c0)) 11:31:07 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000380)={r0}) r1 = open(0x0, 0x0, 0xb) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001800), 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) write(r2, &(0x7f0000000080)="01", 0x292e9) 11:31:07 executing program 5: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) 11:31:07 executing program 6: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 7: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 3: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='map_files\x00') ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000380)={r0}) r1 = open(0x0, 0x0, 0xb) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001800), 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) write(r2, &(0x7f0000000080)="01", 0x292e9) 11:31:07 executing program 5: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 3: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 7: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 6: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) 11:31:07 executing program 4: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:07 executing program 0: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) 11:31:07 executing program 5: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xe57d) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r2}, 0xc) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x7, 0xff, 0x16, 0x9b, 0x0, 0x4, 0x401, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000340), 0x9}, 0x148, 0x41, 0x3, 0x7, 0xe88a, 0x7f, 0x6, 0x0, 0xf7b5, 0x0, 0x9}, 0x0, 0xe, r3, 0x2) setsockopt$sock_timeval(r1, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) 11:31:07 executing program 1: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:07 executing program 3: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:07 executing program 6: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:07 executing program 7: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) [ 127.048952] blktrace: Concurrent blktraces are not allowed on sg0 11:31:07 executing program 7: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) [ 127.116140] BUG: unable to handle page fault for address: ffffed100fffc000 [ 127.116653] #PF: supervisor write access in kernel mode [ 127.117038] #PF: error_code(0x0002) - not-present page [ 127.117415] PGD 7ffd3067 P4D 7ffd3067 PUD 7ffd2067 PMD 7ffd1067 PTE 0 [ 127.117885] Oops: 0002 [#5] PREEMPT SMP KASAN NOPTI [ 127.118241] CPU: 0 PID: 4177 Comm: syz-executor.1 Tainted: G D 6.1.0-rc3-next-20221031 #1 [ 127.118895] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 127.119444] RIP: 0010:__memset+0x24/0x50 [ 127.119752] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 127.120981] RSP: 0018:ffff88800d79fcc0 EFLAGS: 00010216 [ 127.121378] RAX: 0000000000000000 RBX: ffff88800bf4e840 RCX: 1ffffe21fe5fb718 [ 127.121844] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 127.122311] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9d08 [ 127.122806] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 127.123302] R13: ffff88800bf4e840 R14: ffffffff815f27a0 R15: 1ffff1100119501f [ 127.123800] FS: 00007feeffa52700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 [ 127.124364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.124778] CR2: ffffed100fffc000 CR3: 000000000e768000 CR4: 0000000000350ef0 [ 127.125279] Call Trace: [ 127.125475] [ 127.125642] kasan_unpoison+0x23/0x60 [ 127.125929] mempool_exit+0x1c2/0x330 [ 127.126212] bioset_exit+0x2c9/0x630 [ 127.126491] disk_release+0x143/0x490 [ 127.126775] ? disk_release+0x0/0x490 [ 127.127060] ? device_release+0x0/0x250 [ 127.127354] device_release+0xa2/0x250 [ 127.127637] ? device_release+0x0/0x250 [ 127.127920] kobject_put+0x173/0x280 [ 127.128197] put_device+0x1b/0x40 [ 127.128458] put_disk+0x41/0x60 [ 127.128704] loop_control_ioctl+0x4d1/0x630 [ 127.129023] ? loop_control_ioctl+0x0/0x630 [ 127.129356] ? selinux_file_ioctl+0xb1/0x270 [ 127.129689] ? loop_control_ioctl+0x0/0x630 [ 127.130008] __x64_sys_ioctl+0x19a/0x220 [ 127.130308] do_syscall_64+0x3b/0xa0 [ 127.130586] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 127.130960] RIP: 0033:0x7fef024dcb19 [ 127.131226] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 127.132443] RSP: 002b:00007feeffa52188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 127.132956] RAX: ffffffffffffffda RBX: 00007fef025eff60 RCX: 00007fef024dcb19 [ 127.133445] RDX: 0000000000000005 RSI: 0000000000004c81 RDI: 0000000000000005 [ 127.133933] RBP: 00007fef02536f6d R08: 0000000000000000 R09: 0000000000000000 [ 127.134430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.134929] R13: 00007ffdb05417ef R14: 00007feeffa52300 R15: 0000000000022000 [ 127.135414] [ 127.135578] Modules linked in: [ 127.135804] CR2: ffffed100fffc000 [ 127.136042] ---[ end trace 0000000000000000 ]--- [ 127.136363] RIP: 0010:__memset+0x24/0x50 [ 127.136659] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 127.137915] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 127.138277] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 127.138753] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 127.139239] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 127.139735] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 127.140224] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 127.140711] FS: 00007feeffa52700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 [ 127.141248] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.141743] CR2: ffffed100fffc000 CR3: 000000000e768000 CR4: 0000000000350ef0 [ 127.198387] BUG: unable to handle page fault for address: ffffed100fffc000 [ 127.198881] #PF: supervisor write access in kernel mode [ 127.199225] #PF: error_code(0x0002) - not-present page [ 127.199577] PGD 7ffd3067 P4D 7ffd3067 PUD 7ffd2067 PMD 7ffd1067 PTE 0 [ 127.200019] Oops: 0002 [#6] PREEMPT SMP KASAN NOPTI [ 127.200348] CPU: 0 PID: 4171 Comm: syz-executor.6 Tainted: G D 6.1.0-rc3-next-20221031 #1 [ 127.200963] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 127.201499] RIP: 0010:__memset+0x24/0x50 [ 127.201786] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 127.202999] RSP: 0018:ffff88803f73fcc0 EFLAGS: 00010216 [ 127.203372] RAX: 0000000000000000 RBX: ffff88800bf4e6c0 RCX: 1ffffe21fe5fb712 [ 127.203831] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 127.204296] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9cd8 [ 127.204757] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 127.205214] R13: ffff88800bf4e6c0 R14: ffffffff815f27a0 R15: 1ffff1100119541f [ 127.205695] FS: 00007f6cbdc32700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 [ 127.206223] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.206606] CR2: ffffed100fffc000 CR3: 000000001f0e6000 CR4: 0000000000350ef0 [ 127.207070] Call Trace: [ 127.207246] [ 127.207399] kasan_unpoison+0x23/0x60 [ 127.207666] mempool_exit+0x1c2/0x330 [ 127.207934] bioset_exit+0x2c9/0x630 [ 127.208189] disk_release+0x143/0x490 [ 127.208451] ? disk_release+0x0/0x490 [ 127.208715] ? device_release+0x0/0x250 [ 127.208992] device_release+0xa2/0x250 [ 127.209258] ? device_release+0x0/0x250 [ 127.209543] kobject_put+0x173/0x280 [ 127.209805] put_device+0x1b/0x40 [ 127.210043] put_disk+0x41/0x60 [ 127.210272] loop_control_ioctl+0x4d1/0x630 [ 127.210566] ? loop_control_ioctl+0x0/0x630 [ 127.210857] ? loop_control_ioctl+0x0/0x630 [ 127.211145] __x64_sys_ioctl+0x19a/0x220 [ 127.211425] do_syscall_64+0x3b/0xa0 [ 127.211684] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 127.212031] RIP: 0033:0x7f6cc06bcb19 [ 127.212279] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 127.213458] RSP: 002b:00007f6cbdc32188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 127.213947] RAX: ffffffffffffffda RBX: 00007f6cc07cff60 RCX: 00007f6cc06bcb19 [ 127.214407] RDX: 0000000000000004 RSI: 0000000000004c81 RDI: 0000000000000005 [ 127.214870] RBP: 00007f6cc0716f6d R08: 0000000000000000 R09: 0000000000000000 [ 127.215334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.215793] R13: 00007ffd6737c03f R14: 00007f6cbdc32300 R15: 0000000000022000 [ 127.216383] [ 127.216539] Modules linked in: [ 127.216756] CR2: ffffed100fffc000 [ 127.216987] ---[ end trace 0000000000000000 ]--- [ 127.217296] RIP: 0010:__memset+0x24/0x50 [ 127.217628] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 127.218824] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 127.219189] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 127.219685] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 127.220166] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 127.220648] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 127.221131] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 127.221624] FS: 00007f6cbdc32700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 [ 127.222181] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.222592] CR2: ffffed100fffc000 CR3: 000000001f0e6000 CR4: 0000000000350ef0 [ 127.282627] BUG: unable to handle page fault for address: ffffed100fffc000 [ 127.283155] #PF: supervisor write access in kernel mode [ 127.283514] #PF: error_code(0x0002) - not-present page [ 127.283863] PGD 7ffd3067 P4D 7ffd3067 PUD 7ffd2067 PMD 7ffd1067 PTE 0 [ 127.284323] Oops: 0002 [#7] PREEMPT SMP KASAN NOPTI [ 127.284663] CPU: 0 PID: 4169 Comm: syz-executor.4 Tainted: G D 6.1.0-rc3-next-20221031 #1 [ 127.285282] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 127.285845] RIP: 0010:__memset+0x24/0x50 [ 127.286138] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 127.287492] RSP: 0018:ffff88804039fcc0 EFLAGS: 00010216 [ 127.287874] RAX: 0000000000000000 RBX: ffff88800bf4e9c0 RCX: 1ffffe21fe5fb71e [ 127.288379] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 127.288883] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9d38 [ 127.289398] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 127.289904] R13: ffff88800bf4e9c0 R14: ffffffff815f27a0 R15: 1ffff11001196c1f [ 127.290404] FS: 00007f255ae04700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 [ 127.290974] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.291397] CR2: ffffed100fffc000 CR3: 0000000019d30000 CR4: 0000000000350ef0 [ 127.291906] Call Trace: [ 127.292093] [ 127.292261] kasan_unpoison+0x23/0x60 [ 127.292544] mempool_exit+0x1c2/0x330 [ 127.292839] bioset_exit+0x2c9/0x630 [ 127.293118] disk_release+0x143/0x490 [ 127.293422] ? disk_release+0x0/0x490 [ 127.293708] ? device_release+0x0/0x250 [ 127.294002] device_release+0xa2/0x250 [ 127.294288] ? device_release+0x0/0x250 [ 127.294580] kobject_put+0x173/0x280 [ 127.294860] put_device+0x1b/0x40 [ 127.295118] put_disk+0x41/0x60 [ 127.295363] loop_control_ioctl+0x4d1/0x630 [ 127.295681] ? loop_control_ioctl+0x0/0x630 [ 127.296000] ? selinux_file_ioctl+0xb1/0x270 [ 127.296334] ? loop_control_ioctl+0x0/0x630 [ 127.296654] __x64_sys_ioctl+0x19a/0x220 [ 127.296960] do_syscall_64+0x3b/0xa0 [ 127.297245] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 127.297644] RIP: 0033:0x7f255d88eb19 [ 127.297918] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 127.299191] RSP: 002b:00007f255ae04188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 127.299730] RAX: ffffffffffffffda RBX: 00007f255d9a1f60 RCX: 00007f255d88eb19 [ 127.300236] RDX: 0000000000000006 RSI: 0000000000004c81 RDI: 0000000000000005 [ 127.300741] RBP: 00007f255d8e8f6d R08: 0000000000000000 R09: 0000000000000000 [ 127.301246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.302055] R13: 00007ffde51fea4f R14: 00007f255ae04300 R15: 0000000000022000 [ 127.302569] [ 127.302741] Modules linked in: [ 127.302985] CR2: ffffed100fffc000 [ 127.303235] ---[ end trace 0000000000000000 ]--- [ 127.303238] BUG: unable to handle page fault for address: ffffed100fffc000 [ 127.303571] RIP: 0010:__memset+0x24/0x50 [ 127.304025] #PF: supervisor write access in kernel mode [ 127.304312] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 127.304625] #PF: error_code(0x0002) - not-present page [ 127.305891] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 127.306198] PGD 7ffd3067 P4D 7ffd3067 [ 127.306569] [ 127.306574] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 127.306802] PUD 7ffd2067 [ 127.306927] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 127.307343] PMD 7ffd1067 [ 127.307537] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 127.307953] PTE 0 [ 127.308149] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 127.308564] [ 127.308570] Oops: 0002 [#8] PREEMPT SMP KASAN NOPTI [ 127.308721] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 127.309140] CPU: 1 PID: 4179 Comm: syz-executor.3 Tainted: G D 6.1.0-rc3-next-20221031 #1 [ 127.309264] FS: 00007f255ae04700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 [ 127.309563] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 127.310062] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.310610] RIP: 0010:__memset+0x24/0x50 [ 127.311167] CR2: ffffed100fffc000 CR3: 0000000019d30000 CR4: 0000000000350ef0 [ 127.311651] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 127.313876] RSP: 0018:ffff88804031fcc0 EFLAGS: 00010216 [ 127.314199] RAX: 0000000000000000 RBX: ffff88800bf4eb40 RCX: 1ffffe21fe5fb724 [ 127.314627] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 127.315054] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9d68 [ 127.315483] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 127.315912] R13: ffff88800bf4eb40 R14: ffffffff815f27a0 R15: 1ffff1100119681f [ 127.316344] FS: 00007fc5115c8700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 127.316828] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.317184] CR2: ffffed100fffc000 CR3: 000000001f0b4000 CR4: 0000000000350ee0 [ 127.317626] Call Trace: [ 127.317791] [ 127.317935] kasan_unpoison+0x23/0x60 [ 127.318180] mempool_exit+0x1c2/0x330 [ 127.318430] bioset_exit+0x2c9/0x630 [ 127.318673] disk_release+0x143/0x490 [ 127.318917] ? disk_release+0x0/0x490 [ 127.319158] ? device_release+0x0/0x250 [ 127.319411] device_release+0xa2/0x250 [ 127.319658] ? device_release+0x0/0x250 [ 127.319906] kobject_put+0x173/0x280 [ 127.320143] put_device+0x1b/0x40 [ 127.320366] put_disk+0x41/0x60 [ 127.320579] loop_control_ioctl+0x4d1/0x630 [ 127.320852] ? loop_control_ioctl+0x0/0x630 [ 127.321122] ? selinux_file_ioctl+0xb1/0x270 [ 127.321426] ? loop_control_ioctl+0x0/0x630 [ 127.321701] __x64_sys_ioctl+0x19a/0x220 [ 127.321962] do_syscall_64+0x3b/0xa0 [ 127.322203] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 127.322523] RIP: 0033:0x7fc514052b19 [ 127.322754] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 127.323844] RSP: 002b:00007fc5115c8188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 127.324302] RAX: ffffffffffffffda RBX: 00007fc514165f60 RCX: 00007fc514052b19 [ 127.324727] RDX: 0000000000000007 RSI: 0000000000004c81 RDI: 0000000000000005 [ 127.325152] RBP: 00007fc5140acf6d R08: 0000000000000000 R09: 0000000000000000 [ 127.325590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.326036] R13: 00007ffdaf2455ef R14: 00007fc5115c8300 R15: 0000000000022000 [ 127.326470] [ 127.326619] Modules linked in: [ 127.326822] CR2: ffffed100fffc000 [ 127.327036] ---[ end trace 0000000000000000 ]--- [ 127.327330] RIP: 0010:__memset+0x24/0x50 [ 127.327593] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 127.328663] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 127.328986] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 127.329430] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 127.329859] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 127.330287] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 127.330719] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 127.331147] FS: 00007fc5115c8700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 127.331628] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.331984] CR2: ffffed100fffc000 CR3: 000000001f0b4000 CR4: 0000000000350ee0 11:31:08 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) 11:31:08 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) 11:31:08 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) 11:31:08 executing program 0: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) [ 127.432827] blktrace: Concurrent blktraces are not allowed on sg0 11:31:08 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) 11:31:08 executing program 0: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x3e, 0x1, 0xd6c2, 0x0, 0x2}) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'sit0\x00', 0x0}) sendmsg$inet(r4, &(0x7f0000000780)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000300)="6fb9", 0xffeb}], 0x1, &(0x7f0000000700)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @broadcast}}}], 0x20}, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000080)={@empty, @dev={0xac, 0x14, 0x14, 0x3a}, r6}, 0xc) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @private}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x401a012, r7, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0xfffff801}}, './file1\x00'}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000240)={@broadcast, @remote}, 0xc) setsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) 11:31:08 executing program 7: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:08 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) 11:31:08 executing program 5: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:08 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0xd596, 0x4) 11:31:08 executing program 7: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sync_file_range(r0, 0x0, 0x80004080000000, 0x0) 11:31:08 executing program 0: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0]) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)={0x59, 0x7d, 0x0, {{0x0, 0x40, 0x0, 0x0, {}, 0x0, 0x1a809ffd, 0x10001, 0x1, 0x2, '-#', 0x6, '\x02\x02\x02\x02\x02\x02', 0x5, '%}%@:'}, 0x4, ':\'@*', 0xee01, 0xffffffffffffffff, 0xee00}}, 0x59) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62658, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7}, 0x0, 0x1, 0x0, 0x0, 0x8000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) epoll_create(0x400) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) syncfs(r0) [ 127.887932] audit: type=1400 audit(1667215868.580:10): avc: denied { tracepoint } for pid=4225 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 11:31:08 executing program 6: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:08 executing program 1: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:08 executing program 3: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:08 executing program 5: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:08 executing program 0: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0]) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)={0x59, 0x7d, 0x0, {{0x0, 0x40, 0x0, 0x0, {}, 0x0, 0x1a809ffd, 0x10001, 0x1, 0x2, '-#', 0x6, '\x02\x02\x02\x02\x02\x02', 0x5, '%}%@:'}, 0x4, ':\'@*', 0xee01, 0xffffffffffffffff, 0xee00}}, 0x59) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62658, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7}, 0x0, 0x1, 0x0, 0x0, 0x8000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) epoll_create(0x400) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) syncfs(r0) 11:31:08 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0xd596, 0x4) 11:31:08 executing program 7: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sync_file_range(r0, 0x0, 0x80004080000000, 0x0) 11:31:08 executing program 4: r0 = io_uring_setup(0x4f45, &(0x7f0000000240)) io_uring_register$IORING_REGISTER_PROBE(r0, 0x12, 0x0, 0x1) 11:31:08 executing program 4: r0 = io_uring_setup(0x4f45, &(0x7f0000000240)) io_uring_register$IORING_REGISTER_PROBE(r0, 0x12, 0x0, 0x1) 11:31:08 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0xd596, 0x4) 11:31:08 executing program 7: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sync_file_range(r0, 0x0, 0x80004080000000, 0x0) 11:31:08 executing program 0: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0]) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)={0x59, 0x7d, 0x0, {{0x0, 0x40, 0x0, 0x0, {}, 0x0, 0x1a809ffd, 0x10001, 0x1, 0x2, '-#', 0x6, '\x02\x02\x02\x02\x02\x02', 0x5, '%}%@:'}, 0x4, ':\'@*', 0xee01, 0xffffffffffffffff, 0xee00}}, 0x59) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62658, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7}, 0x0, 0x1, 0x0, 0x0, 0x8000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) epoll_create(0x400) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) syncfs(r0) [ 128.225448] BUG: unable to handle page fault for address: ffffed100fffc000 [ 128.225982] #PF: supervisor write access in kernel mode [ 128.226352] #PF: error_code(0x0002) - not-present page [ 128.226716] PGD 7ffd3067 P4D 7ffd3067 PUD 7ffd2067 PMD 7ffd1067 PTE 0 [ 128.227187] Oops: 0002 [#9] PREEMPT SMP KASAN NOPTI [ 128.227613] CPU: 0 PID: 4234 Comm: syz-executor.6 Tainted: G D 6.1.0-rc3-next-20221031 #1 [ 128.228333] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 128.228890] RIP: 0010:__memset+0x24/0x50 [ 128.229191] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 128.230460] RSP: 0018:ffff88803e2dfcc0 EFLAGS: 00010216 [ 128.230918] RAX: 0000000000000000 RBX: ffff88800bf4ee40 RCX: 1ffffe21fe5fb730 [ 128.231520] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 128.232106] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9dc8 [ 128.232637] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 128.233126] R13: ffff88800bf4ee40 R14: ffffffff815f27a0 R15: 1ffff11007c1e41f [ 128.233634] FS: 00007f6cbdc32700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 [ 128.234186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.234588] CR2: ffffed100fffc000 CR3: 000000000e768000 CR4: 0000000000350ef0 [ 128.235073] Call Trace: [ 128.235257] [ 128.235419] kasan_unpoison+0x23/0x60 [ 128.235725] mempool_exit+0x1c2/0x330 [ 128.236058] bioset_exit+0x2c9/0x630 [ 128.236390] disk_release+0x143/0x490 [ 128.236724] ? disk_release+0x0/0x490 [ 128.237053] ? device_release+0x0/0x250 [ 128.237375] device_release+0xa2/0x250 [ 128.237655] ? device_release+0x0/0x250 [ 128.237942] kobject_put+0x173/0x280 [ 128.238214] put_device+0x1b/0x40 [ 128.238468] put_disk+0x41/0x60 [ 128.238710] loop_control_ioctl+0x4d1/0x630 [ 128.239055] ? loop_control_ioctl+0x0/0x630 [ 128.239429] ? selinux_file_ioctl+0xb1/0x270 [ 128.239818] ? loop_control_ioctl+0x0/0x630 [ 128.240194] __x64_sys_ioctl+0x19a/0x220 [ 128.240557] do_syscall_64+0x3b/0xa0 [ 128.240893] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 128.241356] RIP: 0033:0x7f6cc06bcb19 [ 128.241684] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 128.243196] RSP: 002b:00007f6cbdc32188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 128.243833] RAX: ffffffffffffffda RBX: 00007f6cc07cff60 RCX: 00007f6cc06bcb19 [ 128.244427] RDX: 0000000000000000 RSI: 0000000000004c81 RDI: 0000000000000005 [ 128.245020] RBP: 00007f6cc0716f6d R08: 0000000000000000 R09: 0000000000000000 [ 128.245625] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.246219] R13: 00007ffd6737c03f R14: 00007f6cbdc32300 R15: 0000000000022000 [ 128.246833] [ 128.247030] Modules linked in: [ 128.247309] CR2: ffffed100fffc000 [ 128.247603] ---[ end trace 0000000000000000 ]--- [ 128.248004] RIP: 0010:__memset+0x24/0x50 [ 128.248361] Code: 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 48 ab 89 d1 f3 aa 4c 89 c8 e9 4d d4 12 00 66 66 2e 0f 1f 84 00 [ 128.249806] RSP: 0018:ffff8880401d7cc0 EFLAGS: 00010216 [ 128.250230] RAX: 0000000000000000 RBX: ffff88800bf4e0c0 RCX: 1ffffe21fe5fb6fa [ 128.250815] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffed100fffc000 [ 128.251311] RBP: ffff88800bf6ddc0 R08: 0000000000000005 R09: ffffed10017e9c18 [ 128.251801] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800bf6ddc0 [ 128.252293] R13: ffff88800bf4e0c0 R14: ffffffff815f27a0 R15: 1ffff1100112541f [ 128.252787] FS: 00007f6cbdc32700(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 [ 128.253359] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.253768] CR2: ffffed100fffc000 CR3: 000000000e768000 CR4: 0000000000350ef0 11:31:09 executing program 3: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:09 executing program 4: r0 = io_uring_setup(0x4f45, &(0x7f0000000240)) io_uring_register$IORING_REGISTER_PROBE(r0, 0x12, 0x0, 0x1) 11:31:09 executing program 1: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:09 executing program 7: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sync_file_range(r0, 0x0, 0x80004080000000, 0x0) 11:31:09 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0xd596, 0x4) 11:31:09 executing program 5: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:09 executing program 0: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0]) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)={0x59, 0x7d, 0x0, {{0x0, 0x40, 0x0, 0x0, {}, 0x0, 0x1a809ffd, 0x10001, 0x1, 0x2, '-#', 0x6, '\x02\x02\x02\x02\x02\x02', 0x5, '%}%@:'}, 0x4, ':\'@*', 0xee01, 0xffffffffffffffff, 0xee00}}, 0x59) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62658, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7}, 0x0, 0x1, 0x0, 0x0, 0x8000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) epoll_create(0x400) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) syncfs(r0) 11:31:09 executing program 6: mlock2(&(0x7f0000ff7000/0x4000)=nil, 0x4000, 0x0) shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = shmget(0x3, 0xa000, 0x20, &(0x7f0000ff6000/0xa000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) r1 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) mmap$perf(&(0x7f0000fed000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) perf_event_open(&(0x7f00000001c0)={0x4, 0x80, 0x1, 0x8a, 0x20, 0xa9, 0x0, 0x0, 0x8, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_config_ext={0xa000000000000000, 0xa8f}, 0x3a00, 0x5, 0x80000000, 0x4, 0x0, 0x6, 0x3c3f, 0x0, 0x6, 0x0, 0x3}, 0x0, 0x7, 0xffffffffffffffff, 0x2) openat2(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) mincore(&(0x7f0000ff8000/0x2000)=nil, 0x2000, &(0x7f0000000700)=""/4096) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x2, 0x3f, 0x5, 0x3, 0x0, 0x89d9, 0x1000, 0xc, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x8}, 0x8040, 0x1, 0x400, 0x6, 0xa2, 0x0, 0x7, 0x0, 0x4, 0x0, 0x239b}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r2, 0x40089413, &(0x7f0000000180)=0x1) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ff7000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 11:31:09 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:09 executing program 4: r0 = io_uring_setup(0x4f45, &(0x7f0000000240)) io_uring_register$IORING_REGISTER_PROBE(r0, 0x12, 0x0, 0x1) 11:31:09 executing program 7: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:10 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:10 executing program 4: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0]) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)={0x59, 0x7d, 0x0, {{0x0, 0x40, 0x0, 0x0, {}, 0x0, 0x1a809ffd, 0x10001, 0x1, 0x2, '-#', 0x6, '\x02\x02\x02\x02\x02\x02', 0x5, '%}%@:'}, 0x4, ':\'@*', 0xee01, 0xffffffffffffffff, 0xee00}}, 0x59) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x62658, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7}, 0x0, 0x1, 0x0, 0x0, 0x8000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) epoll_create(0x400) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) syncfs(r0) 11:31:10 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:10 executing program 1: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:10 executing program 7: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) r1 = perf_event_open(&(0x7f0000001840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f00000001c0)={0x3, 0x80, 0xcc, 0x6c, 0x1, 0x1, 0x0, 0x2, 0x100, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5378, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x110, 0x7ff, 0x5, 0x4, 0x4, 0xfc3e, 0x5, 0x0, 0x1f, 0x0, 0x100000000}, 0xffffffffffffffff, 0x0, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_triestat\x00') pread64(r2, &(0x7f0000000040)=""/170, 0xaa, 0x200000007fffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000018c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000104000003000000040000000000000004000000000000000300000000000000090000000000000000000000000000000000000000000000000000000000000004000000000000800004000000000000bf0800000000000002000000000000000800"/448]) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x2010, 0xffffffffffffffff, 0x8000000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @private, @initdev}, &(0x7f0000000180)=0xc) r3 = syz_io_uring_setup(0x6427, &(0x7f0000000240)={0x0, 0xaceb, 0x8, 0x0, 0xfd, 0x0, r2}, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000140), &(0x7f00000002c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x200000f, 0x2010, r3, 0x0) 11:31:10 executing program 6: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, @perf_bp={0x0}, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x9, 0x8001, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, r0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000380)=']p\"\xae\x06\xc40\x1a\x1a\\\x9e\x8a\x17@)#\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004I\x1c4P\x0e\xc4!\xc9\xece\x84\x85\xf2\xdb\xd3\xa7_\xe5\x95\x04\xdae\xca\xfd\xe2\xd1\xc5\x13\xf3u\xea\xc0\xb5b[\x9adH~\n\xe1\x86\x1f\xe7s\x04\xe8\xf2$\xae\xa8\xe7\xbd\x05\xb0B\xf2\x9cp\xc73\x9db\xc4\xe8EC\xbd\xc9\xf8\x0e\xd7\x1b\x11\xaf\xbf