Extracting prog: 15m36.684123629s
Minimizing prog: 28m30.939485053s
Simplifying prog options: 5m0.984422095s
Extracting C: 1m25.913840331s
Simplifying C: 0s


extracting reproducer from 38 programs
testing a last program of every proc
single: executing 8 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f30c759300010000000109024a0001010080320904000008ffffff000705810200020007058202000200070583020002000705840200020007050102000200070502020002000705030200020007050402000200"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2-syz_open_dev$hidraw-write$UHID_INPUT2
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000180)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x7, 0x5, 0x57e, 0x306, 0x0, 0x0, "05010900a101c0"}}, 0x11f)
syz_open_dev$hidraw(&(0x7f00000002c0), 0x0, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0x6, {0x7, ' \x00\x00\x00\x00\x00\x00'}}, 0xd)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-nanosleep-mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3b, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040000000000000000000010902290001010080320904000002030000000921110100012267010705810340000107050203400001"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00226701000005200973a100850105200a09031500250275089501a1020a30080a31080a3208b100c00a16031500250575089501a1020a40080a41080a42080a43080a44080a4508b100c00a19031500250575089501a1020a50080a51080a52080a53080a54080a5508b100c00a01021500250675089501a1020a00080a01080a02080a03080a04080a05080a0608b100c00a0e03150027ffffffff752095015500b1020a5214150026ffff75109501550eb1020a522416018026ff7f75109501550eb1020a523416018026ff7f75109501550eb10205200a01021500250675089501a1020a00080a01080a02080a03080a04080a05080a06088100c00a02021500250575089501a1020a10080a11080a12080a13080a14080a15088100c00a5304170000018027ffffffff75209501550e81020a5404170000018027ffffffff75209501550e81020a5504170000018027ffffff7f75209501550e81020a510415002501750895018102c0"], 0x0}, &(0x7f0000000200)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="20010f000000010101010100"/21], 0x0})
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/iio/devices/iio:device0/buffer/enable\x00', 0x2, 0x0)
write(r1, &(0x7f0000000900)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/iio/devices/iio:device1/buffer/enable\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='1\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/bus/iio/devices/iio:device2/buffer/enable\x00', 0x2, 0x0)
write(r3, &(0x7f0000000900)='1\x00', 0x2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-ioctl-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040250580100001000000010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
ioctl(r0, 0x8914, &(0x7f0000000200)="757362300000000000000000000000000100"/40) (async)
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='- - -\x00', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='- - -\x00', 0x5)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='- - -\x00', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='- - -\x00', 0x5)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-openat-write-openat-write-mkdirat-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='0x1d6b\x00', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='0x0104\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0)
write(r2, &(0x7f0000000540)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='dummy_udc.0\x00', 0xb)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mkdirat-openat-write-openat-write-mkdirat-mkdirat-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='0x1d6b\x00', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='0x0104\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0)
write(r2, &(0x7f0000000540)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='dummy_udc.0\x00', 0xb)

program did not crash
single: failed to extract reproducer
bisect: bisecting 38 programs with base timeout 30s
testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 2, 1, 15, 14, 31, 9, 35, 6, 1, 14, 10, 10, 6, 2, 3, 10, 32, 4, 37, 4, 4, 2, 4, 17, 5, 32, 20, 3, 4, 4, 3, 9, 6, 16, 4, 2]
detailed listing:
executing program 1:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000300)=0x3, 0x4)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
sendto$inet6(r1, &(0x7f0000000000)="01040000000000006000000000081140000000000000000000000000000000010000000000000000000000000000000104d2162e00080000", 0x38, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c)
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x7c, &(0x7f0000000200)={0x40, 0x1, 0x4, "04000001"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x7c, &(0x7f0000000400)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000b00)={0x1}, 0x0)
syz_usb_ep_read(r0, 0x4, 0x40, &(0x7f0000001000)=""/64)
syz_usb_ep_write(r0, 0x83, 0x40, &(0x7f0000002000)="0402000100"/64)
executing program 1:
syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000300)={0x20, 0xfe, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_read(0xffffffffffffffff, 0x2, 0x1f, &(0x7f0000000400))
executing program 1:
sendmsg$sock(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000013000500000000000000000003010000100002007664706173696d5f626c6b000a000400766470613000", 0x2e}], 0x1}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dbg\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dbg\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./dbg/split_huge_pages\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/sys/kernel/ns_last_pid\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='30000\n\x00', 0x6)
mmap(&(0x7f0000200000/0x200000)=nil, 0x200000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000200000/0x200000)=nil, 0x200000, 0xe)
madvise(&(0x7f0000200000/0x200000)=nil, 0x200000, 0x17)
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = syz_pidfd_open(r2, 0x0)
pidfd_send_signal(r3, 0x13, 0x0, 0x0)
process_madvise(r3, &(0x7f0000004000)=[{&(0x7f0000200000), 0x200000}], 0x1, 0x14, 0x0)
write(r0, &(0x7f0000000300)='30001,0x7f0000200000,0x7f0000400000\x00', 0x24)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='0x1d6b\x00', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='0x0104\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0)
write(r2, &(0x7f0000000540)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='dummy_udc.0\x00', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/dynamic_events\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='e:my_eprobe raw_syscalls/sys_enter\n', 0x23)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/eprobes/my_eprobe/filter\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='common_pid == 999999\n', 0x15)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./trace/events/eprobes/my_eprobe/enable\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./trace/events/timer/hrtimer_expire_entry/enable\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='1\n', 0x2) (async)
setitimer(0x0, &(0x7f00000002c0)={{0x0, 0x1}, {0x0, 0x1}}, 0x0)
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
getpid()
executing program 3:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040341278560001000000010902220001010080320904000001030000000921110100012266010705810308000a"], 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x1dcd6500}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00226601000005200973a100850105200a09031500250275089501a1020a30080a31080a3208b100c00a16031500250575089501a1020a40080a41080a42080a43080a44080a4508b100c00a19031500250575089501a1020a50080a51080a52080a53080a54080a5508b100c00a01021500250675089501a1020a00080a01080a02080a03080a04080a05080a0608b100c00a0e03150027ffffffff752095015500b1020a5214150026ffff75109501550eb1020a522416018026ff7f75109501550eb1020a523416018026ff7f75109501550eb10205200a01021500250675089501a1020a00080a01080a02080a03080a04080a05080a06088100c00a02021500250575089501a1020a10080a11080a12080a13080a14080a15088100c00a5304170000018027ffffffff75209501550e81020a5404170000018027ffffffff75209501550e81020a5504170000018027ffffff7f75209501550e81020a510415002501750895018102c0"], 0x0}, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="20014000"/70], 0x0})
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/iio/devices/iio:device0/buffer/enable\x00', 0x2, 0x0)
write(r1, &(0x7f0000000500)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/iio/devices/iio:device1/buffer/enable\x00', 0x2, 0x0)
write(r2, &(0x7f0000000500)='1\x00', 0x2)
executing program 3:
r0 = timerfd_create(0x0, 0x0)
clock_settime(0x0, &(0x7f0000000000)={0x64})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
timerfd_settime(r0, 0x1, &(0x7f0000000300)={{}, {0x65, 0x3b9a06b0}}, 0x0)
read(r0, &(0x7f0000000400)=""/8, 0x8)
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
clock_adjtime(0x0, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x0, 0x10})
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000002000)='./sys\x00', &(0x7f0000002040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='1\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/rescan\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='1\n', 0x2)
executing program 3:
syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0})
executing program 32:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='0x1d6b\x00', 0x7)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='0x0104\x00', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.0/c_chmask\x00', 0x2, 0x0)
write(r2, &(0x7f0000000540)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='dummy_udc.0\x00', 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='- - -\x00', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='- - -\x00', 0x5)
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='- - -\x00', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='- - -\x00', 0x5)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000001000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000100)="f4", 0x1}], 0x1, 0x0, &(0x7f0000000000), 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x38f, 0x0, 0x1}, {0x186, 0x0, 0x400000}]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 0:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$sock(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000013000500000000000000000003010000100002007664706173696d5f626c6b000a0004007664706130", 0x2d}], 0x1}, 0x0)
executing program 0:
r0 = syz_usb_connect$uac1(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000406624108000010102030109022400020100c032090400000001010000090401000001020000090401010001020000"], 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000000200)={0x0, 0x0, 0x2, "abcd"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000000200)={0x0, 0x0, 0x2, "abcd"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 5:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040250580100001000000010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000100)={0x1}, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl(r1, 0x8914, &(0x7f0000000200)="757362300000000000000000000000000100"/40)
ioctl(r1, 0x8914, &(0x7f0000000300)="757362310000000000000000000000000100"/40)
ioctl(r1, 0x8914, &(0x7f0000000400)="657468300000000000000000000000000100"/40)
ioctl(r1, 0x8914, &(0x7f0000000500)="657468310000000000000000000000000100"/40)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000001000)="fc4e2ba9", 0x4, 0x1000)
pwrite64(r0, &(0x7f0000001004)="01000000", 0x4, 0x1004)
pwrite64(r0, &(0x7f0000001008)="01000000", 0x4, 0x1008)
pwrite64(r0, &(0x7f0000001048)="01000000", 0x4, 0x1048)
pwrite64(r0, &(0x7f0000001044)="01000000", 0x4, 0x105c)
pwrite64(r0, &(0x7f000000100c)='\b\x00\x00\x00', 0x4, 0x1060)
pwrite64(r0, &(0x7f0000001010)="1000000000000000", 0x8, 0x1080)
pwrite64(r0, &(0x7f0000001018)='\n\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1088)
pwrite64(r0, &(0x7f0000001020)='\b\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1090)
pwrite64(r0, &(0x7f0000001028)="2a4f2ba9", 0x4, 0x10d8)
pwrite64(r0, &(0x7f000000102c)='bitm', 0x4, 0x2000)
pwrite64(r0, &(0x7f0000001030)="04000000", 0x4, 0x2004)
pwrite64(r0, &(0x7f0000001034)="00020000", 0x4, 0x2034)
pwrite64(r0, &(0x7f0000001038)="01000000", 0x4, 0x2038)
pwrite64(r0, &(0x7f000000103c)='\x00\x00\x00\x00', 0x4, 0x203c)
fsync(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='md0\n', 0x4)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='1.2\n', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r3, &(0x7f0000000800)='1:0\n', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0)
write(r4, &(0x7f0000000a00)='writemostly\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000c00)='readonly\n', 0x9)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0)
write(r5, &(0x7f0000000e00)='1024\n', 0x5)
executing program 2:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040000000000000000000010902200001010080320904000002080650000705810200020007050202000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000300)={0x20, 0xfe, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_read(r0, 0x2, 0x1f, &(0x7f0000000400))
syz_usb_ep_write(r0, 0x81, 0x24, &(0x7f0000000500)="058000321f000000544f53484942412043442d524f4d20202020202020202020312e3030")
executing program 0:
syz_usb_connect(0x0, 0x1b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403412785600000000000109020900000100c000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/usb/devices/1-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/usb/devices/1-1/power/control\x00', 0x2, 0x0)
write(r1, &(0x7f0000000110)='auto\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/usb/devices/2-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r2, &(0x7f0000000100)='0\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/usb/devices/2-1/power/control\x00', 0x2, 0x0)
write(r3, &(0x7f0000000110)='auto\x00', 0x5)
r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/devices/3-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r4, &(0x7f0000000100)='0\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/devices/3-1/power/control\x00', 0x2, 0x0)
write(r5, &(0x7f0000000110)='auto\x00', 0x5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/usb/devices/4-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r6, &(0x7f0000000100)='0\x00', 0x2)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/devices/4-1/power/control\x00', 0x2, 0x0)
write(r7, &(0x7f0000000110)='auto\x00', 0x5)
r8 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/usb/devices/5-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r8, &(0x7f0000000100)='0\x00', 0x2)
r9 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0)
write(r9, &(0x7f0000000110)='auto\x00', 0x5)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/usb/devices/6-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r10, &(0x7f0000000100)='0\x00', 0x2)
r11 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/usb/devices/6-1/power/control\x00', 0x2, 0x0)
write(r11, &(0x7f0000000110)='auto\x00', 0x5)
r12 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/usb/devices/7-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r12, &(0x7f0000000100)='0\x00', 0x2)
r13 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/devices/7-1/power/control\x00', 0x2, 0x0)
write(r13, &(0x7f0000000110)='auto\x00', 0x5)
r14 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/8-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r14, &(0x7f0000000100)='0\x00', 0x2)
r15 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/usb/devices/8-1/power/control\x00', 0x2, 0x0)
write(r15, &(0x7f0000000110)='auto\x00', 0x5)
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000540)='0\n', 0x2)
executing program 5:
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040010001000000000000010902240001010080000904000001030000000921000000012208000905810308000a0000"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0022080000000600ff0901a101c0"], 0x0}, &(0x7f0000000200)={0x2c, &(0x7f0000000210)={0x20, 0xa}, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000001900)={0x2}, 0x0)
syz_open_dev$hidraw(&(0x7f0000001a00), 0x0, 0x0)
executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$sock(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000013000500000000000000000003010000100002007664706173696d5f626c6b000a0004007664706130", 0x2d}], 0x1}, 0x0)
executing program 2:
r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040700c0ef000000102030109022200010100c00009040000010300000009211101000122130007058103400001"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x13, {[@global=@item_012={0x2, 0x1, 0x0, "ff00"}, @local=@item_012={0x1, 0x2, 0x0, "01"}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "00ff"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, &(0x7f0000000100)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x22, 0x13, {[@global=@item_012={0x2, 0x1, 0x0, "ff00"}, @local=@item_012={0x1, 0x2, 0x0, "01"}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @global=@item_012={0x1, 0x1, 0x1, '\x00'}, @global=@item_012={0x2, 0x1, 0x2, "00ff"}, @global=@item_012={0x1, 0x1, 0x7, '\b'}, @global=@item_012={0x1, 0x1, 0x9, '@'}, @main=@item_012={0x1, 0x0, 0x8, "02"}, @main=@item_012={0x0, 0x0, 0xc}]}}, 0x0}, &(0x7f00000001c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000a00)='./nfsd\x00', &(0x7f0000000b00)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./rpc_pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./rpc_pipefs\x00', &(0x7f0000000400)='rpc_pipefs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000c00)='./nfsd/versions\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000e00)='./nfsd/portlist\x00', 0x2, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x2, 0x0)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x2, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipefs/nfsd/cld\x00', 0x2, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipefs/nfsd/cld\x00', 0x2, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipefs/nfsd/cld\x00', 0x2, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt\x00', 0x1ff)
executing program 0:
r0 = syz_usb_connect$printer(0x3, 0x0, &(0x7f0000000040), 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
syz_open_dev$char_usb(0xc, 0xb4, 0x0)
syz_usb_disconnect(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000001000)="fc4e2ba9", 0x4, 0x1000)
pwrite64(r0, &(0x7f0000001004)="01000000", 0x4, 0x1004)
pwrite64(r0, &(0x7f0000001008)="01000000", 0x4, 0x1008)
pwrite64(r0, &(0x7f0000001048)="01000000", 0x4, 0x1048)
pwrite64(r0, &(0x7f0000001044)="01000000", 0x4, 0x105c)
pwrite64(r0, &(0x7f000000100c)='\b\x00\x00\x00', 0x4, 0x1060)
pwrite64(r0, &(0x7f0000001010)="1000000000000000", 0x8, 0x1080)
pwrite64(r0, &(0x7f0000001018)='\n\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1088)
pwrite64(r0, &(0x7f0000001020)='\b\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1090)
pwrite64(r0, &(0x7f0000001028)="2a4f2ba9", 0x4, 0x10d8)
pwrite64(r0, &(0x7f000000102c)='bitm', 0x4, 0x2000)
pwrite64(r0, &(0x7f0000001030)="04000000", 0x4, 0x2004)
pwrite64(r0, &(0x7f0000001034)="00020000", 0x4, 0x2034)
pwrite64(r0, &(0x7f0000001038)="01000000", 0x4, 0x2038)
pwrite64(r0, &(0x7f000000103c)='\x00\x00\x00\x00', 0x4, 0x203c)
fsync(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='md0\n', 0x4)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r2, &(0x7f0000000600)='1.2\n', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r3, &(0x7f0000000800)='1:0\n', 0x4)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0)
write(r4, &(0x7f0000000a00)='writemostly\n', 0xc)
write(0xffffffffffffffff, &(0x7f0000000c00)='readonly\n', 0x9)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./sys/block/md0/md/bitmap/backlog\x00', 0x1, 0x0)
write(r5, &(0x7f0000000e00)='1024\n', 0x5)
executing program 0:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040250580100001000000010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
ioctl(r0, 0x8914, &(0x7f0000000200)="757362300000000000000000000000000100"/40) (async)
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/max_speed\x00', 0x2, 0x0)
write(r0, &(0x7f0000000640)='super-speed\x00', 0xb)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000540)='0\n', 0x2)
executing program 4:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000405e048e021401000000010902200001010080fa0904000002ff5d01000705810320000407050203200008"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, &(0x7f0000000500)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, &(0x7f0000000500)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_disconnect(r0)
executing program 2:
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040000000000000000000010902200001010080320904000002080650000705810200020007050202000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000300)={0x20, 0xfe, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_read(r0, 0x2, 0x1f, &(0x7f0000000400))
executing program 5:
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x10000000}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/usb/devices/1-1/power/control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000400)='auto\x00', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/usb/devices/1-1/power/autosuspend_delay_ms\x00', 0x2, 0x0)
write(r1, &(0x7f0000000600)='0\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000600)='0\x00', 0x2)
executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1)
r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040ae74, &(0x7f0000000000)={0x1000, 0x3})
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x11, r2, 0x0)
madvise(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x17)
madvise(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x64)
executing program 5:
r0 = syz_usb_connect$hid(0x0, 0x3b, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040000000000000000000010902290001010080320904000002030000000921110100012267010705810340000107050203400001"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00226701000005200973a100850105200a09031500250275089501a1020a30080a31080a3208b100c00a16031500250575089501a1020a40080a41080a42080a43080a44080a4508b100c00a19031500250575089501a1020a50080a51080a52080a53080a54080a5508b100c00a01021500250675089501a1020a00080a01080a02080a03080a04080a05080a0608b100c00a0e03150027ffffffff752095015500b1020a5214150026ffff75109501550eb1020a522416018026ff7f75109501550eb1020a523416018026ff7f75109501550eb10205200a01021500250675089501a1020a00080a01080a02080a03080a04080a05080a06088100c00a02021500250575089501a1020a10080a11080a12080a13080a14080a15088100c00a5304170000018027ffffffff75209501550e81020a5404170000018027ffffffff75209501550e81020a5504170000018027ffffff7f75209501550e81020a510415002501750895018102c0"], 0x0}, &(0x7f0000000200)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="20010f000000010101010100"/21], 0x0})
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/iio/devices/iio:device0/buffer/enable\x00', 0x2, 0x0)
write(r1, &(0x7f0000000900)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/iio/devices/iio:device1/buffer/enable\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='1\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/bus/iio/devices/iio:device2/buffer/enable\x00', 0x2, 0x0)
write(r3, &(0x7f0000000900)='1\x00', 0x2)
executing program 2:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000180)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x7, 0x5, 0x57e, 0x306, 0x0, 0x0, "05010900a101c0"}}, 0x11f)
syz_open_dev$hidraw(&(0x7f00000002c0), 0x0, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0x6, {0x7, ' \x00\x00\x00\x00\x00\x00'}}, 0xd)
executing program 4:
syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f30c759300010000000109024a0001010080320904000008ffffff000705810200020007058202000200070583020002000705840200020007050102000200070502020002000705030200020007050402000200"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 8 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep
detailed listing:
executing program 0:
syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f30c759300010000000109024a0001010080320904000008ffffff000705810200020007058202000200070583020002000705840200020007050102000200070502020002000705030200020007050402000200"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x2}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2-syz_open_dev$hidraw-write$UHID_INPUT2
detailed listing:
executing program 0:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000180)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x7, 0x5, 0x57e, 0x306, 0x0, 0x0, "05010900a101c0"}}, 0x11f)
syz_open_dev$hidraw(&(0x7f00000002c0), 0x0, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0x6, {0x7, ' \x00\x00\x00\x00\x00\x00'}}, 0xd)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-nanosleep-mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x0, 0x3b, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040000000000000000000010902290001010080320904000002030000000921110100012267010705810340000107050203400001"], 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00226701000005200973a100850105200a09031500250275089501a1020a30080a31080a3208b100c00a16031500250575089501a1020a40080a41080a42080a43080a44080a4508b100c00a19031500250575089501a1020a50080a51080a52080a53080a54080a5508b100c00a01021500250675089501a1020a00080a01080a02080a03080a04080a05080a0608b100c00a0e03150027ffffffff752095015500b1020a5214150026ffff75109501550eb1020a522416018026ff7f75109501550eb1020a523416018026ff7f75109501550eb10205200a01021500250675089501a1020a00080a01080a02080a03080a04080a05080a06088100c00a02021500250575089501a1020a10080a11080a12080a13080a14080a15088100c00a5304170000018027ffffffff75209501550e81020a5404170000018027ffffffff75209501550e81020a5504170000018027ffffff7f75209501550e81020a510415002501750895018102c0"], 0x0}, &(0x7f0000000200)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="20010f000000010101010100"/21], 0x0})
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
syz_usb_control_io$hid(r0, &(0x7f00000001c0), &(0x7f0000000200))
nanosleep(&(0x7f0000000500)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000600)='./sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/iio/devices/iio:device0/buffer/enable\x00', 0x2, 0x0)
write(r1, &(0x7f0000000900)='1\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/iio/devices/iio:device1/buffer/enable\x00', 0x2, 0x0)
write(r2, &(0x7f0000000900)='1\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/bus/iio/devices/iio:device2/buffer/enable\x00', 0x2, 0x0)
write(r3, &(0x7f0000000900)='1\x00', 0x2)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$nl_generic-syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-nanosleep-ioctl-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040250580100001000000010902200001010080320904000002ff0000000705810200020007050202000200"], 0x0)
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0)
ioctl(r0, 0x8914, &(0x7f0000000200)="757362300000000000000000000000000100"/40) (async)
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r1, &(0x7f0000001000)={0x2c, &(0x7f0000001100)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001200)={0x84, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='- - -\x00', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='- - -\x00', 0x5)

program crashed: WARNING: kobject bug in __scsi_remove_device
single: successfully extracted reproducer
found reproducer with 10 syscalls
minimizing guilty program
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='- - -\x00', 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='- - -\x00', 0x5)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\x00', 0x1)
write(0xffffffffffffffff, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-openat-write-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180), 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='- - -\x00', 0x5)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, 0x0, 0x0)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
extracting C reproducer
testing compiled C program (duration=1m21.402142582s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
program did not crash
simplifying guilty program options
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
extracting C reproducer
testing compiled C program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
program did not crash
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program did not crash
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program did not crash
validation run: crashed=false
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
validation run: crashed=true
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program did not crash
validation run: crashed=false
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program did not crash
validation run: crashed=false
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
validation run: crashed=true
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program did not crash
validation run: crashed=false
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program did not crash
validation run: crashed=false
testing program (duration=1m21.402142582s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/scsi_device/0:0:0:0/device/delete\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='- - -\x00', 0x5)
write(0xffffffffffffffff, &(0x7f0000000240), 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
validation run: crashed=true
reproducing took 1h2m40.437712611s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kobject: '(null)' (ffff88811e0bc548): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 0 PID: 401 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734
Modules linked in:
CPU: 0 UID: 0 PID: 401 Comm: syz.4.18 Not tainted syzkaller #0 57989d98ccfe184428db69a81b942df9a58aae8a
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734
Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 f4 94 44 fc 48 8b 33 48 c7 c7 a0 0f 9b 86 48 89 da e8 22 8d 68 fb <0f> 0b eb 0f e8 69 ba eb fb e9 9c 01 00 00 e8 5f ba eb fb 4c 8d 7b
RSP: 0018:ffffc90000f1f1f8 EFLAGS: 00010246
RAX: b621fe86f571df00 RBX: ffff88811e0bc548 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc90000f1f220 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e9f334 R12: 00000000fffffff4
R13: ffff88811e0bc584 R14: 1ffff11023c178b0 R15: 0000000000000000
FS:  0000555555c57500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdece5ec300 CR3: 0000000117906000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 put_device+0x23/0x40 drivers/base/core.c:3800
 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501
 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379
 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207
 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754
 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline]
 scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x75f/0xfd0 fs/read_write.c:684
 ksys_write+0x145/0x260 fs/read_write.c:737
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x7f/0x90 fs/read_write.c:746
 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5ff839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5d699cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5ff8625fa0 RCX: 00007f5ff839e159
RDX: 0000000000000005 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f5ff8435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ff8625fac R14: 00007f5ff8625fa0 R15: 00007f5ff8625fa0
 </TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 401 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 401 Comm: syz.4.18 Tainted: G        W          syzkaller #0 57989d98ccfe184428db69a81b942df9a58aae8a
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28
Code: 05 01 48 c7 c7 60 f6 51 86 e8 c3 1c 55 fe 0f 0b eb da e8 0a 4a d8 fe c6 05 89 2b 36 05 01 48 c7 c7 c0 f6 51 86 e8 a7 1c 55 fe <0f> 0b eb be e8 ee 49 d8 fe c6 05 6a 2b 36 05 01 48 c7 c7 00 f6 51
RSP: 0018:ffffc90000f1f1d8 EFLAGS: 00010246
RAX: b621fe86f571df00 RBX: 0000000000000003 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc90000f1f1e8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e9f334 R12: 0000000000000000
R13: ffff88811e0bc584 R14: ffff88811e0bc580 R15: ffff88811e0bc580
FS:  0000555555c57500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556a3f94e8 CR3: 0000000117906000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 kref_put include/linux/kref.h:64 [inline]
 kobject_put+0x25a/0x2a0 lib/kobject.c:737
 put_device+0x23/0x40 drivers/base/core.c:3800
 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501
 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379
 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207
 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754
 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline]
 scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x75f/0xfd0 fs/read_write.c:684
 ksys_write+0x145/0x260 fs/read_write.c:737
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x7f/0x90 fs/read_write.c:746
 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5ff839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5d699cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5ff8625fa0 RCX: 00007f5ff839e159
RDX: 0000000000000005 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f5ff8435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ff8625fac R14: 00007f5ff8625fa0 R15: 00007f5ff8625fa0
 </TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
kobject: '(null)' (ffff88811e0bc1d0): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 1 PID: 401 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734
Modules linked in:
CPU: 1 UID: 0 PID: 401 Comm: syz.4.18 Tainted: G        W          syzkaller #0 57989d98ccfe184428db69a81b942df9a58aae8a
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734
Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 f4 94 44 fc 48 8b 33 48 c7 c7 a0 0f 9b 86 48 89 da e8 22 8d 68 fb <0f> 0b eb 0f e8 69 ba eb fb e9 9c 01 00 00 e8 5f ba eb fb 4c 8d 7b
RSP: 0018:ffffc90000f1f1f8 EFLAGS: 00010246
RAX: b621fe86f571df00 RBX: ffff88811e0bc1d0 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc90000f1f220 R08: ffffc90000f1eee7 R09: 1ffff920001e3ddc
R10: dffffc0000000000 R11: fffff520001e3ddd R12: ffffffff86631450
R13: ffff88811e0bc20c R14: 1ffff11023c17841 R15: 0000000000000000
FS:  0000555555c57500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556a3f94e8 CR3: 0000000117906000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 put_device+0x23/0x40 drivers/base/core.c:3800
 __scsi_remove_device+0x32d/0x3c0 drivers/scsi/scsi_sysfs.c:1527
 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379
 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207
 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754
 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline]
 scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x75f/0xfd0 fs/read_write.c:684
 ksys_write+0x145/0x260 fs/read_write.c:737
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x7f/0x90 fs/read_write.c:746
 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5ff839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5d699cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5ff8625fa0 RCX: 00007f5ff839e159
RDX: 0000000000000005 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f5ff8435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ff8625fac R14: 00007f5ff8625fa0 R15: 00007f5ff8625fa0
 </TASK>
---[ end trace 0000000000000000 ]---
scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured
------------[ cut here ]------------
kernel BUG at drivers/scsi/scsi_scan.c:594!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 401 Comm: syz.4.18 Tainted: G        W          syzkaller #0 57989d98ccfe184428db69a81b942df9a58aae8a
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594
Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 a8 69 81 fe e9 39 ff ff ff e8 5e 8f 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 05 88 9d 74 90 90 90
RSP: 0018:ffffc90000f1f7a8 EFLAGS: 00010293
RAX: ffffffff835ee7e2 RBX: ffff88811c7c5000 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: ffffc90000f1f7d0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520001e3ee0 R12: ffff88811c7c5000
R13: ffff88811c7c53c4 R14: 1ffff110238f8a78 R15: 0000000000000005
FS:  0000555555c57500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556a3f94e8 CR3: 0000000117906000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 __scsi_scan_target+0x62c/0xc20 drivers/scsi/scsi_scan.c:1771
 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline]
 scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x75f/0xfd0 fs/read_write.c:684
 ksys_write+0x145/0x260 fs/read_write.c:737
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x7f/0x90 fs/read_write.c:746
 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5ff839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5d699cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5ff8625fa0 RCX: 00007f5ff839e159
RDX: 0000000000000005 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f5ff8435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ff8625fac R14: 00007f5ff8625fa0 R15: 00007f5ff8625fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594
Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 a8 69 81 fe e9 39 ff ff ff e8 5e 8f 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 05 88 9d 74 90 90 90
RSP: 0018:ffffc90000f1f7a8 EFLAGS: 00010293
RAX: ffffffff835ee7e2 RBX: ffff88811c7c5000 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: ffffc90000f1f7d0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520001e3ee0 R12: ffff88811c7c5000
R13: ffff88811c7c53c4 R14: 1ffff110238f8a78 R15: 0000000000000005
FS:  0000555555c57500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdece5ec300 CR3: 0000000117906000 CR4: 00000000003526b0

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kobject: '(null)' (ffff88811e0bc548): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 0 PID: 401 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734
Modules linked in:
CPU: 0 UID: 0 PID: 401 Comm: syz.4.18 Not tainted syzkaller #0 57989d98ccfe184428db69a81b942df9a58aae8a
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734
Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 f4 94 44 fc 48 8b 33 48 c7 c7 a0 0f 9b 86 48 89 da e8 22 8d 68 fb <0f> 0b eb 0f e8 69 ba eb fb e9 9c 01 00 00 e8 5f ba eb fb 4c 8d 7b
RSP: 0018:ffffc90000f1f1f8 EFLAGS: 00010246
RAX: b621fe86f571df00 RBX: ffff88811e0bc548 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc90000f1f220 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e9f334 R12: 00000000fffffff4
R13: ffff88811e0bc584 R14: 1ffff11023c178b0 R15: 0000000000000000
FS:  0000555555c57500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdece5ec300 CR3: 0000000117906000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 put_device+0x23/0x40 drivers/base/core.c:3800
 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501
 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379
 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207
 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754
 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline]
 scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x75f/0xfd0 fs/read_write.c:684
 ksys_write+0x145/0x260 fs/read_write.c:737
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x7f/0x90 fs/read_write.c:746
 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5ff839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5d699cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5ff8625fa0 RCX: 00007f5ff839e159
RDX: 0000000000000005 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f5ff8435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ff8625fac R14: 00007f5ff8625fa0 R15: 00007f5ff8625fa0
 </TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 401 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 401 Comm: syz.4.18 Tainted: G        W          syzkaller #0 57989d98ccfe184428db69a81b942df9a58aae8a
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28
Code: 05 01 48 c7 c7 60 f6 51 86 e8 c3 1c 55 fe 0f 0b eb da e8 0a 4a d8 fe c6 05 89 2b 36 05 01 48 c7 c7 c0 f6 51 86 e8 a7 1c 55 fe <0f> 0b eb be e8 ee 49 d8 fe c6 05 6a 2b 36 05 01 48 c7 c7 00 f6 51
RSP: 0018:ffffc90000f1f1d8 EFLAGS: 00010246
RAX: b621fe86f571df00 RBX: 0000000000000003 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc90000f1f1e8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e9f334 R12: 0000000000000000
R13: ffff88811e0bc584 R14: ffff88811e0bc580 R15: ffff88811e0bc580
FS:  0000555555c57500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556a3f94e8 CR3: 0000000117906000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 kref_put include/linux/kref.h:64 [inline]
 kobject_put+0x25a/0x2a0 lib/kobject.c:737
 put_device+0x23/0x40 drivers/base/core.c:3800
 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501
 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379
 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207
 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754
 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline]
 scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x75f/0xfd0 fs/read_write.c:684
 ksys_write+0x145/0x260 fs/read_write.c:737
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x7f/0x90 fs/read_write.c:746
 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5ff839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5d699cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5ff8625fa0 RCX: 00007f5ff839e159
RDX: 0000000000000005 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f5ff8435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ff8625fac R14: 00007f5ff8625fa0 R15: 00007f5ff8625fa0
 </TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
kobject: '(null)' (ffff88811e0bc1d0): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 1 PID: 401 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734
Modules linked in:
CPU: 1 UID: 0 PID: 401 Comm: syz.4.18 Tainted: G        W          syzkaller #0 57989d98ccfe184428db69a81b942df9a58aae8a
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734
Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 f4 94 44 fc 48 8b 33 48 c7 c7 a0 0f 9b 86 48 89 da e8 22 8d 68 fb <0f> 0b eb 0f e8 69 ba eb fb e9 9c 01 00 00 e8 5f ba eb fb 4c 8d 7b
RSP: 0018:ffffc90000f1f1f8 EFLAGS: 00010246
RAX: b621fe86f571df00 RBX: ffff88811e0bc1d0 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc90000f1f220 R08: ffffc90000f1eee7 R09: 1ffff920001e3ddc
R10: dffffc0000000000 R11: fffff520001e3ddd R12: ffffffff86631450
R13: ffff88811e0bc20c R14: 1ffff11023c17841 R15: 0000000000000000
FS:  0000555555c57500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556a3f94e8 CR3: 0000000117906000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 put_device+0x23/0x40 drivers/base/core.c:3800
 __scsi_remove_device+0x32d/0x3c0 drivers/scsi/scsi_sysfs.c:1527
 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379
 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207
 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754
 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline]
 scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x75f/0xfd0 fs/read_write.c:684
 ksys_write+0x145/0x260 fs/read_write.c:737
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x7f/0x90 fs/read_write.c:746
 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5ff839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5d699cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5ff8625fa0 RCX: 00007f5ff839e159
RDX: 0000000000000005 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f5ff8435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ff8625fac R14: 00007f5ff8625fa0 R15: 00007f5ff8625fa0
 </TASK>
---[ end trace 0000000000000000 ]---
scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured
------------[ cut here ]------------
kernel BUG at drivers/scsi/scsi_scan.c:594!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 401 Comm: syz.4.18 Tainted: G        W          syzkaller #0 57989d98ccfe184428db69a81b942df9a58aae8a
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594
Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 a8 69 81 fe e9 39 ff ff ff e8 5e 8f 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 05 88 9d 74 90 90 90
RSP: 0018:ffffc90000f1f7a8 EFLAGS: 00010293
RAX: ffffffff835ee7e2 RBX: ffff88811c7c5000 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: ffffc90000f1f7d0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520001e3ee0 R12: ffff88811c7c5000
R13: ffff88811c7c53c4 R14: 1ffff110238f8a78 R15: 0000000000000005
FS:  0000555555c57500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556a3f94e8 CR3: 0000000117906000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 __scsi_scan_target+0x62c/0xc20 drivers/scsi/scsi_scan.c:1771
 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline]
 scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x319/0x510 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:591 [inline]
 vfs_write+0x75f/0xfd0 fs/read_write.c:684
 ksys_write+0x145/0x260 fs/read_write.c:737
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x7f/0x90 fs/read_write.c:746
 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5ff839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd5d699cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5ff8625fa0 RCX: 00007f5ff839e159
RDX: 0000000000000005 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f5ff8435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5ff8625fac R14: 00007f5ff8625fa0 R15: 00007f5ff8625fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594
Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 a8 69 81 fe e9 39 ff ff ff e8 5e 8f 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 05 88 9d 74 90 90 90
RSP: 0018:ffffc90000f1f7a8 EFLAGS: 00010293
RAX: ffffffff835ee7e2 RBX: ffff88811c7c5000 RCX: ffff888130439300
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: ffffc90000f1f7d0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520001e3ee0 R12: ffff88811c7c5000
R13: ffff88811c7c53c4 R14: 1ffff110238f8a78 R15: 0000000000000005
FS:  0000555555c57500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdece5ec300 CR3: 0000000117906000 CR4: 00000000003526b0