Extracting prog: 45m21.030685995s Minimizing prog: 45m13.748082462s Simplifying prog options: 0s Extracting C: 41.648330372s Simplifying C: 13m14.195174936s extracting reproducer from 27 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCSKEYCODE_V2-openat$vhost_vsock-ioctl$VHOST_SET_OWNER detailed listing: executing program 0: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_type-write$cgroup_type-socket$inet_sctp-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-bpf$PROG_LOAD-openat$ttyS3-openat$procfs-ioctl$IOC_WATCH_QUEUE_SET_SIZE-ioctl$KVM_SET_VCPU_EVENTS-openat$vga_arbiter detailed listing: executing program 0: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_type(r0, &(0x7f0000000180), 0x9) socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x81b, &(0x7f0000000640)={0x0, 0x30b5, 0x400, 0x4001002, 0x372}, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x3600, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0xfffffffe, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x6, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x13) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000001c0)=@x86={0xd2, 0x19, 0x0, 0x0, 0x4, 0x8, 0x26, 0x3, 0x0, 0x8, 0xa, 0x3, 0x0, 0x7, 0x6, 0x6, 0x8d, 0x0, 0x4, '\x00', 0x2, 0x2}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-prctl$PR_SCHED_CORE-sched_setattr-sendfile-sched_setattr-userfaultfd-socket$nl_xfrm-timer_create-fcntl$lock-mmap-syz_io_uring_setup-mmap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$xdp detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_setup(0x2f8d, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) socket$xdp(0x2c, 0x3, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-openat$kvm-socket$kcm-ioctl$SIOCSIFHWADDR-sendmsg$inet-socket$inet_tcp-syz_open_dev$sndpcmp-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-openat$proc_mixer-ioctl$SNDRV_PCM_IOCTL_PREPARE-ioctl$SNDRV_PCM_IOCTL_FORWARD-ioctl$SNDRV_PCM_IOCTL_START-ioctl$SNDRV_PCM_IOCTL_PAUSE-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-bpf$MAP_CREATE_CONST_STR-ioctl$SNDRV_PCM_IOCTL_PREPARE-getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS-ioctl$KVM_CREATE_VM-socket$nl_route-sendmsg$nl_route-ioctl$KVM_CREATE_VCPU-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-openat$kvm-socket$kcm-ioctl$SIOCSIFHWADDR-sendmsg$inet-socket$inet_tcp-syz_open_dev$sndpcmp-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-openat$proc_mixer-ioctl$SNDRV_PCM_IOCTL_PREPARE-ioctl$SNDRV_PCM_IOCTL_FORWARD-ioctl$SNDRV_PCM_IOCTL_START-ioctl$SNDRV_PCM_IOCTL_PAUSE-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-bpf$MAP_CREATE_CONST_STR-ioctl$SNDRV_PCM_IOCTL_PREPARE-getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS-ioctl$KVM_CREATE_VM-sendmsg$nl_route-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 27 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 22, 19, 22, 8, 19, 29, 24, 13, 12, 6, 29, 3, 4, 18, 13, 27, 14, 10, 19, 27, 27, 6, 29, 16, 14, 4] detailed listing: executing program 0: r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 2: r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x1, 0x0) ftruncate(0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002ac0)=[{{&(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000180)=[@ip_retopts={{0x14, 0x0, 0x7, {[@rr={0x7, 0x3, 0x5c}]}}}], 0x18}}], 0x1, 0x50008000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b00"], 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xe}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000700000024000180060005004e230000060001000200051b08000300ac1414aa"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x404e881) syz_clone3(&(0x7f00000036c0)={0x0, &(0x7f00000000c0), 0x0, 0x0, {0x1b}, &(0x7f0000000400)=""/216, 0xd8, 0x0, 0x0}, 0x58) sendmsg$NL80211_CMD_NOTIFY_RADAR(0xffffffffffffffff, 0x0, 0xc041) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x8985, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r7 = dup(r1) syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0x3e80, 0x800, 0x1, 0x32c, 0x0, r2}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe, 0x0, r2}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f00000015c0), 0x2300, 0x0) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000040)=0x1) dup2(r8, r0) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) executing program 3: r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x1, 0x0) ftruncate(0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x50008000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b00"], 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xe}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000700000024000180060005004e230000060001000200051b08000300ac1414aa"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) executing program 0: r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000000b2e2b5ab40bf85edaca83"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x44, &(0x7f0000000580)=ANY=[@ANYBLOB="000301"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000000), 0x104, 0xaa180) ioctl$HIDIOCSFLAG(r1, 0x4004480f, &(0x7f0000000040)=0x3) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) readv(r1, &(0x7f00000003c0), 0x0) executing program 1: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) executing program 2: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, 0x0) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r8 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r8, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 1: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 4: r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x9}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x109) r2 = gettid() ptrace$ARCH_SET_CPUID(0x1e, r2, 0x1, 0x1012) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000100)={0xc0, 0x112, 0x27}, 0x18) timer_create(0x0, 0x0, &(0x7f0000000300)) sendmsg$NFT_BATCH(r0, &(0x7f0000000680)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000640)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_DELOBJ={0x14, 0x14, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x4}}, @NFT_MSG_DELFLOWTABLE={0xb0, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_FLOWTABLE_HOOK={0x9c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x90, 0x3, 0x0, 0x1, [{0x14, 0x1, 'pimreg\x00'}, {0x14, 0x1, 'caif0\x00'}, {0x14, 0x1, 'nr0\x00'}, {0x14, 0x1, 'tunl0\x00'}, {0x14, 0x1, 'veth1_virt_wifi\x00'}, {0x14, 0x1, 'pim6reg\x00'}, {0x14, 0x1, 'ip6tnl0\x00'}]}]}]}, @NFT_MSG_DELFLOWTABLE={0x14, 0x18, 0xa, 0x0, 0x0, 0x0, {0x5, 0x0, 0x4}}, @NFT_MSG_NEWFLOWTABLE={0x64, 0x16, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELOBJ={0xf8, 0x14, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_OBJ_USERDATA={0xd6, 0x8, "89de822da3151ec88ae5b2fb121a0e27ba1925c9ecb8eb59a8a0c196a70d4518c53024f74b958c543c1c22e8bd26354e3d3ad167714c121625dd27ecf1ba54c06d80b4bc29f4f3dafe1d1a87b1809c893004eb4699125ca7712dc3bea31801d8da6307c9d58328cadf4442c6d9fd6f62f3392ac67a7e640e5695f6c87661c324d6edd4e74d49fc998b13d3cd600056008e297b28df32b1edb1a85f1f6dae9384e5f2e9247cff2b262491739602718bf6b6332cf304502593ce8780e9233c49316ec4be4ef6e48429cdce377ede3703f5fc2a"}, @NFTA_OBJ_USERDATA={0xa, 0x8, "9a6b1964dc21"}]}, @NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x288}, 0x1, 0x0, 0x0, 0x48000}, 0x840) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fsetxattr$security_capability(r1, &(0x7f0000000200), 0x0, 0x0, 0x0) close(0x3) executing program 2: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) executing program 3: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) executing program 4: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}]}, 0x28}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r8 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r8, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 3: r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6047, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x20, "", [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xfd, 0xf, 0xbe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x18, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00!'], 0x0, 0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000002000)="03") syz_usb_ep_write(r0, 0x82, 0x0, 0x0) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r7) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) executing program 3: r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x20006, &(0x7f0000000300)) r0 = eventfd2(0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e24, 0x4, @private1, 0x9}}, 0x7, 0x4, 0x2, 0x3, 0x54, 0x6, 0xf5}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x10000001}) ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r3) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000000540)) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000001300)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050204e5"], 0x0) socket(0x1e, 0x5, 0x20000005) syz_usb_ep_read(r4, 0x1, 0x0, 0x0) syz_usb_ep_write(r4, 0x81, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000240)) listen(0xffffffffffffffff, 0x3) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000280)=0x521f) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x2}, &(0x7f0000000100)=0x0) timer_settime(r5, 0x0, &(0x7f0000000200)={{}, {0x0, 0x989680}}, 0x0) rt_sigtimedwait(&(0x7f0000000000)={[0x7]}, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, 0x8) close(0x3) fsync(r3) executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe}}], 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 4: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 3: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 1: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) executing program 1: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r7 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r7, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_setup(0x2f8d, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) socket$xdp(0x2c, 0x3, 0x0) executing program 1: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_type(r0, &(0x7f0000000180), 0x9) socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x81b, &(0x7f0000000640)={0x0, 0x30b5, 0x400, 0x4001002, 0x372}, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x3600, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0xfffffffe, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x6, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x13) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000001c0)=@x86={0xd2, 0x19, 0x0, 0x0, 0x4, 0x8, 0x26, 0x3, 0x0, 0x8, 0xa, 0x3, 0x0, 0x7, 0x6, 0x6, 0x8d, 0x0, 0x4, '\x00', 0x2, 0x2}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) executing program 2: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCSKEYCODE_V2-openat$vhost_vsock-ioctl$VHOST_SET_OWNER detailed listing: executing program 0: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_type-write$cgroup_type-socket$inet_sctp-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-bpf$PROG_LOAD-openat$ttyS3-openat$procfs-ioctl$IOC_WATCH_QUEUE_SET_SIZE-ioctl$KVM_SET_VCPU_EVENTS-openat$vga_arbiter detailed listing: executing program 0: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_type(r0, &(0x7f0000000180), 0x9) socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x81b, &(0x7f0000000640)={0x0, 0x30b5, 0x400, 0x4001002, 0x372}, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x3600, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0xfffffffe, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x6, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x13) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000001c0)=@x86={0xd2, 0x19, 0x0, 0x0, 0x4, 0x8, 0x26, 0x3, 0x0, 0x8, 0xa, 0x3, 0x0, 0x7, 0x6, 0x6, 0x8d, 0x0, 0x4, '\x00', 0x2, 0x2}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-prctl$PR_SCHED_CORE-sched_setattr-sendfile-sched_setattr-userfaultfd-socket$nl_xfrm-timer_create-fcntl$lock-mmap-syz_io_uring_setup-mmap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$xdp detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_setup(0x2f8d, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) socket$xdp(0x2c, 0x3, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-openat$kvm-socket$kcm-ioctl$SIOCSIFHWADDR-sendmsg$inet-socket$inet_tcp-syz_open_dev$sndpcmp-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-openat$proc_mixer-ioctl$SNDRV_PCM_IOCTL_PREPARE-ioctl$SNDRV_PCM_IOCTL_FORWARD-ioctl$SNDRV_PCM_IOCTL_START-ioctl$SNDRV_PCM_IOCTL_PAUSE-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-bpf$MAP_CREATE_CONST_STR-ioctl$SNDRV_PCM_IOCTL_PREPARE-getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS-ioctl$KVM_CREATE_VM-socket$nl_route-sendmsg$nl_route-ioctl$KVM_CREATE_VCPU-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-openat$kvm-socket$kcm-ioctl$SIOCSIFHWADDR-sendmsg$inet-socket$inet_tcp-syz_open_dev$sndpcmp-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-openat$proc_mixer-ioctl$SNDRV_PCM_IOCTL_PREPARE-ioctl$SNDRV_PCM_IOCTL_FORWARD-ioctl$SNDRV_PCM_IOCTL_START-ioctl$SNDRV_PCM_IOCTL_PAUSE-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-bpf$MAP_CREATE_CONST_STR-ioctl$SNDRV_PCM_IOCTL_PREPARE-getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS-ioctl$KVM_CREATE_VM-sendmsg$nl_route-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 27 programs with base timeout 1m40s testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 22, 19, 22, 8, 19, 29, 24, 13, 12, 6, 29, 3, 4, 18, 13, 27, 14, 10, 19, 27, 27, 6, 29, 16, 14, 4] detailed listing: executing program 0: r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 2: r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x1, 0x0) ftruncate(0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002ac0)=[{{&(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000180)=[@ip_retopts={{0x14, 0x0, 0x7, {[@rr={0x7, 0x3, 0x5c}]}}}], 0x18}}], 0x1, 0x50008000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b00"], 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xe}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000700000024000180060005004e230000060001000200051b08000300ac1414aa"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x404e881) syz_clone3(&(0x7f00000036c0)={0x0, &(0x7f00000000c0), 0x0, 0x0, {0x1b}, &(0x7f0000000400)=""/216, 0xd8, 0x0, 0x0}, 0x58) sendmsg$NL80211_CMD_NOTIFY_RADAR(0xffffffffffffffff, 0x0, 0xc041) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x8985, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r7 = dup(r1) syz_ublk_setup_queues(r7, r6, &(0x7f0000000180)={0x0, 0x3e80, 0x800, 0x1, 0x32c, 0x0, r2}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe, 0x0, r2}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f00000015c0), 0x2300, 0x0) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000040)=0x1) dup2(r8, r0) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) executing program 3: r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x1, 0x0) ftruncate(0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x50008000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b00"], 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xe}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000700000024000180060005004e230000060001000200051b08000300ac1414aa"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) executing program 0: r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000000b2e2b5ab40bf85edaca83"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x44, &(0x7f0000000580)=ANY=[@ANYBLOB="000301"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000000), 0x104, 0xaa180) ioctl$HIDIOCSFLAG(r1, 0x4004480f, &(0x7f0000000040)=0x3) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) readv(r1, &(0x7f00000003c0), 0x0) executing program 1: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) executing program 2: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, 0x0) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r8 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r8, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 1: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 4: r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x9}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x109) r2 = gettid() ptrace$ARCH_SET_CPUID(0x1e, r2, 0x1, 0x1012) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000100)={0xc0, 0x112, 0x27}, 0x18) timer_create(0x0, 0x0, &(0x7f0000000300)) sendmsg$NFT_BATCH(r0, &(0x7f0000000680)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000640)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_DELOBJ={0x14, 0x14, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x4}}, @NFT_MSG_DELFLOWTABLE={0xb0, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_FLOWTABLE_HOOK={0x9c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x90, 0x3, 0x0, 0x1, [{0x14, 0x1, 'pimreg\x00'}, {0x14, 0x1, 'caif0\x00'}, {0x14, 0x1, 'nr0\x00'}, {0x14, 0x1, 'tunl0\x00'}, {0x14, 0x1, 'veth1_virt_wifi\x00'}, {0x14, 0x1, 'pim6reg\x00'}, {0x14, 0x1, 'ip6tnl0\x00'}]}]}]}, @NFT_MSG_DELFLOWTABLE={0x14, 0x18, 0xa, 0x0, 0x0, 0x0, {0x5, 0x0, 0x4}}, @NFT_MSG_NEWFLOWTABLE={0x64, 0x16, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELOBJ={0xf8, 0x14, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_OBJ_USERDATA={0xd6, 0x8, "89de822da3151ec88ae5b2fb121a0e27ba1925c9ecb8eb59a8a0c196a70d4518c53024f74b958c543c1c22e8bd26354e3d3ad167714c121625dd27ecf1ba54c06d80b4bc29f4f3dafe1d1a87b1809c893004eb4699125ca7712dc3bea31801d8da6307c9d58328cadf4442c6d9fd6f62f3392ac67a7e640e5695f6c87661c324d6edd4e74d49fc998b13d3cd600056008e297b28df32b1edb1a85f1f6dae9384e5f2e9247cff2b262491739602718bf6b6332cf304502593ce8780e9233c49316ec4be4ef6e48429cdce377ede3703f5fc2a"}, @NFTA_OBJ_USERDATA={0xa, 0x8, "9a6b1964dc21"}]}, @NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x288}, 0x1, 0x0, 0x0, 0x48000}, 0x840) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fsetxattr$security_capability(r1, &(0x7f0000000200), 0x0, 0x0, 0x0) close(0x3) executing program 2: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) executing program 3: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) executing program 4: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}]}, 0x28}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r8 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r8, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 3: r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6047, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x20, "", [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xfd, 0xf, 0xbe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x18, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00!'], 0x0, 0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000002000)="03") syz_usb_ep_write(r0, 0x82, 0x0, 0x0) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r7) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) executing program 3: r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x20006, &(0x7f0000000300)) r0 = eventfd2(0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e24, 0x4, @private1, 0x9}}, 0x7, 0x4, 0x2, 0x3, 0x54, 0x6, 0xf5}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x10000001}) ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r3) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000000540)) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000001300)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050204e5"], 0x0) socket(0x1e, 0x5, 0x20000005) syz_usb_ep_read(r4, 0x1, 0x0, 0x0) syz_usb_ep_write(r4, 0x81, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000240)) listen(0xffffffffffffffff, 0x3) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000280)=0x521f) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x2}, &(0x7f0000000100)=0x0) timer_settime(r5, 0x0, &(0x7f0000000200)={{}, {0x0, 0x989680}}, 0x0) rt_sigtimedwait(&(0x7f0000000000)={[0x7]}, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, 0x8) close(0x3) fsync(r3) executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe}}], 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 4: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 3: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 1: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) executing program 1: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r7 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r7, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_setup(0x2f8d, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) socket$xdp(0x2c, 0x3, 0x0) executing program 1: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_type(r0, &(0x7f0000000180), 0x9) socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x81b, &(0x7f0000000640)={0x0, 0x30b5, 0x400, 0x4001002, 0x372}, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x3600, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0xfffffffe, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x6, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x13) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000001c0)=@x86={0xd2, 0x19, 0x0, 0x0, 0x4, 0x8, 0x26, 0x3, 0x0, 0x8, 0xa, 0x3, 0x0, 0x7, 0x6, 0x6, 0x8d, 0x0, 0x4, '\x00', 0x2, 0x2}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) executing program 2: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: bisecting 27 programs bisect: split chunks (needed=false): <27> bisect: split chunk #0 of len 27 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 6, 29, 3, 4, 18, 13, 27, 14, 10, 19, 27, 27, 6, 29, 16, 14, 4] detailed listing: executing program 2: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) executing program 3: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) executing program 4: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}]}, 0x28}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r8 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r8, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 3: r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6047, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x20, "", [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xfd, 0xf, 0xbe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x18, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00!'], 0x0, 0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000002000)="03") syz_usb_ep_write(r0, 0x82, 0x0, 0x0) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r7) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) executing program 3: r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x20006, &(0x7f0000000300)) r0 = eventfd2(0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e24, 0x4, @private1, 0x9}}, 0x7, 0x4, 0x2, 0x3, 0x54, 0x6, 0xf5}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x10000001}) ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r3) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000000540)) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r4 = syz_usb_connect(0x3, 0x40, &(0x7f0000001300)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050204e5"], 0x0) socket(0x1e, 0x5, 0x20000005) syz_usb_ep_read(r4, 0x1, 0x0, 0x0) syz_usb_ep_write(r4, 0x81, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000240)) listen(0xffffffffffffffff, 0x3) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000280)=0x521f) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x2}, &(0x7f0000000100)=0x0) timer_settime(r5, 0x0, &(0x7f0000000200)={{}, {0x0, 0x989680}}, 0x0) rt_sigtimedwait(&(0x7f0000000000)={[0x7]}, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, 0x8) close(0x3) fsync(r3) executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40, 0x10001, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe}}], 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 4: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 3: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 1: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) executing program 1: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r7 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r7, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_setup(0x2f8d, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) socket$xdp(0x2c, 0x3, 0x0) executing program 1: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_type(r0, &(0x7f0000000180), 0x9) socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x81b, &(0x7f0000000640)={0x0, 0x30b5, 0x400, 0x4001002, 0x372}, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x3600, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0xfffffffe, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x6, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x13) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000001c0)=@x86={0xd2, 0x19, 0x0, 0x0, 0x4, 0x8, 0x26, 0x3, 0x0, 0x8, 0xa, 0x3, 0x0, 0x7, 0x6, 0x6, 0x8d, 0x0, 0x4, '\x00', 0x2, 0x2}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) executing program 2: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 19, 27, 27, 6, 29, 16, 14, 4] detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 4: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 3: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 1: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) executing program 1: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r7 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r7, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_setup(0x2f8d, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) socket$xdp(0x2c, 0x3, 0x0) executing program 1: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_type(r0, &(0x7f0000000180), 0x9) socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x81b, &(0x7f0000000640)={0x0, 0x30b5, 0x400, 0x4001002, 0x372}, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x3600, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0xfffffffe, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x6, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x13) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000001c0)=@x86={0xd2, 0x19, 0x0, 0x0, 0x4, 0x8, 0x26, 0x3, 0x0, 0x8, 0xa, 0x3, 0x0, 0x7, 0x6, 0x6, 0x8d, 0x0, 0x4, '\x00', 0x2, 0x2}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) executing program 2: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <9> bisect: split chunk #0 of len 9 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [29, 16, 14, 4] detailed listing: executing program 1: clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000500)=""/139, &(0x7f00000005c0)=0x8b) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newrule={0x24, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000003c0)={@val={0xa, 0x806}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x10, 0x11, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], {0x4f19, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x8, 0x100, @val=0xd7a919ca9eb57b16}}}}}}}}}, 0x4a) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x96, "25bbc0834ec51a41c20a4fe34f94ee68e8a02d31450b050da0de2cf8fb33290a33254201c2edebe6725757979253295aae50d41ca164d67cd0b0e95767d50854775dffec166646fafb7241224d7cc33b6063b3d839605dcbd1b9b878f406504103fd7789bacce2575e1493e513fee1830e843e9927fe81d13f01e175a3c3b77ee3d6fc6d674883efcb12400cbeca1b29940feb1e666c"}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01300134b1ff"}) r7 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r7, 0x891c, &(0x7f0000000a80)={'veth1_to_team\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}) executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r0, r0, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_setup(0x2f8d, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) socket$xdp(0x2c, 0x3, 0x0) executing program 1: r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_type(r0, &(0x7f0000000180), 0x9) socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_ublk_setup_io_uring(0x81b, &(0x7f0000000640)={0x0, 0x30b5, 0x400, 0x4001002, 0x372}, &(0x7f0000000300)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x3600, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb351, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0xfffffffe, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5e8, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x6, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x13) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000001c0)=@x86={0xd2, 0x19, 0x0, 0x0, 0x4, 0x8, 0x26, 0x3, 0x0, 0x8, 0xa, 0x3, 0x0, 0x7, 0x6, 0x6, 0x8d, 0x0, 0x4, '\x00', 0x2, 0x2}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) executing program 2: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 19, 27, 27, 6] detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 4: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 3: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 1: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) program crashed: WARNING: ODEBUG bug in vub300_disconnect bisect: the chunk can be dropped bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 6] detailed listing: executing program 3: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 1: syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30af, 0x0, 0x1, 0x158}, 0x0, 0x0, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 19, 27] detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 4: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-openat$kvm-socket$kcm-ioctl$SIOCSIFHWADDR-sendmsg$inet-socket$inet_tcp-syz_open_dev$sndpcmp-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-openat$proc_mixer-ioctl$SNDRV_PCM_IOCTL_PREPARE-ioctl$SNDRV_PCM_IOCTL_FORWARD-ioctl$SNDRV_PCM_IOCTL_START-ioctl$SNDRV_PCM_IOCTL_PAUSE-syz_ublk_setup_io_uring-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-bpf$MAP_CREATE_CONST_STR-ioctl$SNDRV_PCM_IOCTL_PREPARE-getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS-ioctl$KVM_CREATE_VM-sendmsg$nl_route-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS-syz_usb_control_io$hid detailed listing: executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$kcm(0x2, 0x1000000000000002, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$inet(r2, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c000000000000000000000007000000441805"], 0x30}, 0x7e8166965e22236a) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, &(0x7f0000000200)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x602, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r4, 0x40084149, &(0x7f0000000080)=0xfd8) ioctl$SNDRV_PCM_IOCTL_START(r4, 0x4142, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r4, 0x40044145, &(0x7f0000001540)=0x2) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0x10}}, 0x2, 0x0, 0x9690, 0x6, 0x2, 0x4, 0x8}, &(0x7f00000005c0)=0x9c) r12 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddd, 0x70bd26, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0xfe, 0x0, 0xff, 0x0, 0x20002200}}, 0x1c}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x48f, 0x0, 0x7fffff00036dfb}]}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 19] detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 4: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-syz_80211_join_ibss-syz_80211_join_ibss-inotify_add_watch-socket$inet-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-socket$packet-sendto$packet-ioctl$sock_inet6_udp_SIOCINQ-bpf$BPF_PROG_ATTACH-sendto$packet-socket$nl_generic-socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$NL80211_CMD_REGISTER_FRAME-sendmsg$NL80211_CMD_FRAME-syz_ublk_setup_io_uring-syz_ublk_add_dev detailed listing: executing program 4: r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040), 0x6, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000000c0), 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@fallback, 0xffffffffffffffff, 0xb, 0x3}, 0x20) sendto$packet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in6=@remote, @in=@broadcast, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0xc}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x2b}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x1, 0x1, 0x1, 0x4, 0x4, 0x80000001}, {{@in=@broadcast, 0x4d5, 0x32}, 0xa, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x0, 0x48, 0x4, 0x40dfff, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x2b}, 0x6, @in=@rand_addr=0x64010101, 0x0, 0x5, 0x1, 0x3, 0x0, 0x2, 0x6}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYRES8=0x0, @ANYRES32=r2, @ANYRESDEC=r1, @ANYRESOCT=r2], 0x44}}, 0x0) r6 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffd, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x0, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xff7f, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdbf}}}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-socket$inet6_tcp-connect$inet6-unshare-setsockopt$inet6_tcp_TCP_ULP-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 2: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-socket$inet6_tcp-connect$inet6-unshare-setsockopt$inet6_tcp_TCP_ULP-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host bisect: concatenation succeeded found reproducer with 10 syscalls minimizing guilty program testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-socket$inet6_tcp-connect$inet6-unshare-setsockopt$inet6_tcp_TCP_ULP-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-socket$inet6_tcp-connect$inet6-unshare-setsockopt$inet6_tcp_TCP_ULP-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-socket$inet6_tcp-connect$inet6-unshare-setsockopt$inet6_tcp_TCP_ULP detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-socket$inet6_tcp-connect$inet6-unshare-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) unshare(0x24060400) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-socket$inet6_tcp-connect$inet6-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-socket$inet6_tcp-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="40f1ff000000433964c714809ea5bb70f5a605e1f04554b88ddb6f939f60947960a6937e30f04512139d76f6ac3ce4499315ae1eace097896ed69019e6a3b4e8564057fd75bc720ac0dea487e3174d5d19df4ba8cc1a1f0acb9068700aeba1957fcf865e484dfaa2aa46ae2adb6ab01d7d02168c66789202b017c6b1c76a1f2eafbbf925486eeb43c37a6946cb64f567eadce4771b6be331be11376150449e837f55f5e268c3c8f04061fc7dfad3885a8b15c550520fd862666855d3b4070000000c23866fbf160b371a838b021e8393a0d015201ef6f9df6ad4f9b49bd337d1c78163bc9bb15add2f7af1ac74c7cb16a97800000000000000a8b2839cdfd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash extracting C reproducer testing compiled C program (duration=1m23.763823686s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host simplifying C reproducer testing compiled C program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program did not crash testing compiled C program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program crashed: BUG: sleeping function called from invalid context in mmc_free_host testing compiled C program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io program did not crash testing program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true testing program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash validation run: crashed=false testing program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true testing program (duration=1m23.763823686s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="50000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: BUG: sleeping function called from invalid context in mmc_free_host validation run: crashed=true reproducing took 1h51m9.917815073s repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 locks held by swapper/1/0: 1, last CPU#1: #0: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 6b 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 42 22 00 fb f4 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0000:ffffc900001a7e40 EFLAGS: 00000246 RAX: 00000000001515ff RBX: ffffffff819bed60 RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e4170b9 RDI: ffffffff8c6dad80 RBP: ffffc900001a7f10 R08: ffff8880b8733a1b R09: 1ffff110170e6743 R10: dffffc0000000000 R11: ffffed10170e6744 R12: 0000000000000000 R13: 1ffff11003cd1bb8 R14: 1ffff92000034fd0 R15: dffffc0000000000 arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157 ODEBUG: object ffffc90000a18a80 is NOT on stack ffffc900001a0000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: swapper/1/0 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#1: swapper/1/0 WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#1: swapper/1/0 Modules linked in: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline] RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798 Code: cc cc cc 41 ff c7 44 89 3d 49 10 e8 15 48 c7 c1 80 b6 6d 8c 48 c7 c7 e0 b6 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 8d 62 3c fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 e1 6a 6d 0a 3b 05 df RSP: 0000:ffffc90000a189b8 EFLAGS: 00010046 RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: ea5f037a6be9b200 RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffff88801e68dde0 R08: 0000000000000100 R09: 1ffff110170e48e2 R10: dffffc0000000000 R11: ffffed10170e48e3 R12: 1ffff9200014314c R13: ffff8880704c6578 R14: dffffc0000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888124dc6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f7ffa190 CR3: 000000007e818000 CR4: 00000000003526f0 Call Trace: __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 6b 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 42 22 00 fb f4 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0000:ffffc900001a7e40 EFLAGS: 00000246 RAX: 00000000001515ff RBX: ffffffff819bed60 RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e4170b9 RDI: ffffffff8c6dad80 RBP: ffffc900001a7f10 R08: ffff8880b8733a1b R09: 1ffff110170e6743 R10: dffffc0000000000 R11: ffffed10170e6744 R12: 0000000000000000 R13: 1ffff11003cd1bb8 R14: 1ffff92000034fd0 R15: dffffc0000000000 arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157 ---------------- Code disassembly (best guess): 0: 6b 87 02 c3 cc cc cc imul $0xffffffcc,-0x33333cfe(%rdi),%eax 7: cc int3 8: cc int3 9: cc int3 a: cc int3 b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: f3 0f 1e fa endbr64 1f: 66 90 xchg %ax,%ax 21: 0f 00 2d 13 42 22 00 verw 0x224213(%rip) # 0x22423b 28: fb sti 29: f4 hlt * 2a: e9 8c 08 03 00 jmp 0x308bb <-- trapping instruction 2f: cc int3 30: cc int3 31: cc int3 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: cc int3 37: cc int3 38: cc int3 39: cc int3 3a: cc int3 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop final repro crashed as (corrupted=false): BUG: sleeping function called from invalid context at kernel/workqueue.c:4561 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 preempt_count: 101, expected: 0 RCU nest depth: 0, expected: 0 locks held by swapper/1/0: 1, last CPU#1: #0: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 6b 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 42 22 00 fb f4 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0000:ffffc900001a7e40 EFLAGS: 00000246 RAX: 00000000001515ff RBX: ffffffff819bed60 RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e4170b9 RDI: ffffffff8c6dad80 RBP: ffffc900001a7f10 R08: ffff8880b8733a1b R09: 1ffff110170e6743 R10: dffffc0000000000 R11: ffffed10170e6744 R12: 0000000000000000 R13: 1ffff11003cd1bb8 R14: 1ffff92000034fd0 R15: dffffc0000000000 arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157 ODEBUG: object ffffc90000a18a80 is NOT on stack ffffc900001a0000, but annotated. ------------[ cut here ]------------ 1 WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#1: swapper/1/0 WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#1: swapper/1/0 WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#1: swapper/1/0 Modules linked in: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline] RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798 Code: cc cc cc 41 ff c7 44 89 3d 49 10 e8 15 48 c7 c1 80 b6 6d 8c 48 c7 c7 e0 b6 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 8d 62 3c fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 e1 6a 6d 0a 3b 05 df RSP: 0000:ffffc90000a189b8 EFLAGS: 00010046 RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: ea5f037a6be9b200 RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffff88801e68dde0 R08: 0000000000000100 R09: 1ffff110170e48e2 R10: dffffc0000000000 R11: ffffed10170e48e3 R12: 1ffff9200014314c R13: ffff8880704c6578 R14: dffffc0000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff888124dc6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f7ffa190 CR3: 000000007e818000 CR4: 00000000003526f0 Call Trace: __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline] wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x226/0x860 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] invoke_softirq kernel/softirq.c:519 [inline] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 6b 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 42 22 00 fb f4 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0000:ffffc900001a7e40 EFLAGS: 00000246 RAX: 00000000001515ff RBX: ffffffff819bed60 RCX: 8000000000000001 RDX: 0000000000000001 RSI: ffffffff8e4170b9 RDI: ffffffff8c6dad80 RBP: ffffc900001a7f10 R08: ffff8880b8733a1b R09: 1ffff110170e6743 R10: dffffc0000000000 R11: ffffed10170e6744 R12: 0000000000000000 R13: 1ffff11003cd1bb8 R14: 1ffff92000034fd0 R15: dffffc0000000000 arch_safe_halt arch/x86/kernel/process.c:767 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:768 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x2e0/0x540 kernel/sched/idle.c:355 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157 ---------------- Code disassembly (best guess): 0: 6b 87 02 c3 cc cc cc imul $0xffffffcc,-0x33333cfe(%rdi),%eax 7: cc int3 8: cc int3 9: cc int3 a: cc int3 b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: f3 0f 1e fa endbr64 1f: 66 90 xchg %ax,%ax 21: 0f 00 2d 13 42 22 00 verw 0x224213(%rip) # 0x22423b 28: fb sti 29: f4 hlt * 2a: e9 8c 08 03 00 jmp 0x308bb <-- trapping instruction 2f: cc int3 30: cc int3 31: cc int3 32: cc int3 33: cc int3 34: cc int3 35: cc int3 36: cc int3 37: cc int3 38: cc int3 39: cc int3 3a: cc int3 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop