Extracting prog: 36m16.66622962s
Minimizing prog: 2h17m4.821834136s
Simplifying prog options: 9m58.111403619s
Extracting C: 1m22.630127854s
Simplifying C: 0s


extracting reproducer from 58 programs
testing a last program of every proc
single: executing 13 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$tipc-bind$tipc-listen-socket$tipc-sendmsg$tipc-socket$inet6_tcp-bind$inet6-listen-setsockopt$SO_BINDTODEVICE-bind$inet6-socket$inet6-bind$inet6-listen-listen-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10)
listen(r0, 0x0)
r1 = socket$tipc(0x1e, 0x5, 0x0)
sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f0000000340)=[{&(0x7f00000002c0)='/', 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x10040)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10)
bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r3 = socket$inet6(0xa, 0x5, 0x0)
bind$inet6(r3, &(0x7f0000000200)={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4}, 0x1c)
listen(r3, 0x50)
listen(0xffffffffffffffff, 0x5)
syz_emit_ethernet(0x4f, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6c2d01000019840100000000000000000002000000010102fe8000000000000000000000000000aaa5ba94e385673ccfd3fe184ab0643975bcc85fbf438632261b"], 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET-syz_genetlink_get_family_id$nl80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-sendmsg$NL80211_CMD_REGISTER_FRAME-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-socket$nl_generic-sendmsg$NL80211_CMD_REGISTER_FRAME-sendmsg$NL80211_CMD_TRIGGER_SCAN
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r1=>0x0})
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, 0x0)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r5=>0x0})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', <r8=>0x0})
r9 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r7, 0x1, 0x3f000000, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x48000)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r2, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-bpf$MAP_CREATE_CONST_STR-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-write-syz_emit_ethernet-openat-ftruncate-pwrite64-syz_open_dev$loop-ioctl$LOOP_SET_FD-openat-write-openat-socket$kcm-sendmsg$kcm-write-bpf$PROG_LOAD-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff)
mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000200)='./sys_mnt\x00', &(0x7f0000000300)='sysfs\x00', 0x0, &(0x7f0000000400)='\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='md0\n\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000000000000000feffffff180100002000732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000050000008500000072000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a700000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r3}, 0xc)
write(r1, &(0x7f0000000600)='1.0\n\x00', 0x4)
syz_emit_ethernet(0x66, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd606410a60030000000000000000000000000ffff00000000fe8000000000000000000000000000aa2900000000000000223427d5c9a46b9ea14172170a013589317d2af31ba55431762f462a5abc3f46494ee91bfca594d5"], 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./file0\x00', 0x42, 0x1ff)
ftruncate(r4, 0x200000)
pwrite64(r4, &(0x7f0000001000)="fc4e2ba90100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006400000000000000010000000000000000080000000000004000000002000000000000000000000000000000000000000000000000000000000000000000000000000000f00f000000000000f00f000000000000000000000000000000000000000000000000000000000000000000006400000001000000000000000000000000000000ec772ca902000000000000000000000000000000000000000000000000000000000000000000000001000000000001", 0xe7, 0x1fe000)
r5 = syz_open_dev$loop(&(0x7f0000000800), 0x0, 0x2)
ioctl$LOOP_SET_FD(r5, 0x4c00, r4)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r6, &(0x7f0000000a00)='7:0\n\x00', 0x4)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys_mnt/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
r8 = socket$kcm(0x1e, 0x1, 0x0)
sendmsg$kcm(r8, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000300)="80", 0x1}], 0x13}, 0x44)
write(r7, &(0x7f0000000600)='rtsx_usb_ms\x00', 0xc)
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys_mnt/bus/platform/drivers/rtsx_usb_ms/bind\x00', 0x1, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_open_procfs-bpf$MAP_CREATE-bpf$PROG_LOAD-socket-ioctl$sock_SIOCETHTOOL-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-bpf$MAP_CREATE-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-sendmsg$key-socket$kcm-memfd_create-pwritev-sendfile-bpf$PROG_LOAD
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_open_procfs(0xffffffffffffffff, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x19, 0x0, 0x0, 0x0}, 0x94)
r2 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x9, 0x2, 0x818, 0x0, 0x0, 0x0, 0x2, 0x7, 0x9, 0x8, 0x0, 0x8001, 0x6, 0x9, 0x0, 0x3, [0x1, 0x6]}})
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x69, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1500000004000000080000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\a\x00'/28], 0x50)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0)
r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
r5 = socket$kcm(0x29, 0x2, 0x0)
r6 = memfd_create(&(0x7f0000000000)='e\xf4E\x88-\x00', 0x0)
pwritev(r6, &(0x7f0000000040)=[{&(0x7f0000000480)="db", 0x1}], 0x1, 0x4000001, 0x0)
sendfile(r5, r6, 0x0, 0x8000fb00)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x2, &(0x7f0000000540)=@raw=[@generic={0x7, 0x4, 0x0, 0x0, 0xfffffff8}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dsp-mkdirat-mount-close-socket$inet6-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-gettid-syz_open_dev$sndmidi-openat$panthor-bind$inet6-syz_emit_ethernet-creat-fsopen-fsconfig$FSCONFIG_SET_FD-mkdir-mkdir-rmdir-syz_clone-openat-write-mkdir-mount-mkdir-mkdir-openat-unlinkat
detailed listing:
executing program 0:
openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='jffs2\x00', 0x0, &(0x7f0000000140)='compr=none\x00')
close(0xffffffffffffffff)
r0 = socket$inet6(0xa, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
gettid()
syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
openat$panthor(0xffffff9c, 0x0, 0x2, 0x0)
bind$inet6(r0, 0x0, 0x0)
syz_emit_ethernet(0x9a, &(0x7f00000003c0)={@link_local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "1b00", 0x64, 0x11, 0x0, @local, @mcast2, {[], {0x4000, 0xe25, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x2, "1983426a97e3503bbbc12ef01ae488918c1ea89a08a25f78de9f802d2628cc4b", "b6af91bfb69252b136c8f50eaee89ebe", {"26e39726e261b1997fe90de7841c2e1f", "8def4140df2b9c11e876f120f5f7bfc5"}}}}}}}}, 0x0)
creat(0x0, 0xa)
r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0)
fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, 0xffffffffffffffff)
mkdir(&(0x7f00000002c0)='./file0\x00', 0x0)
mkdir(0x0, 0x0)
rmdir(&(0x7f0000000280)='./file0/file0\x00')
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff)
write(0xffffffffffffffff, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff)
mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x3, 0x0)
unlinkat(0xffffffffffffff9c, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r2 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000080)={r3, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r5 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r5, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r4, &(0x7f00000002c0)='snd_aloop.0', 0xb)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f0000000040)={0x2c, &(0x7f0000000000)=ANY=[@ANYRESDEC=r1, @ANYRES32=r1, @ANYRES64=r0, @ANYRES16=r1, @ANYRES8=r0, @ANYRES8=r1], 0x0, 0x0, 0x0, 0x0}, 0x0)

program crashed: INFO: task hung in trigger_card_free
single: successfully extracted reproducer
found reproducer with 20 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write-syz_usb_control_io
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r2 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000080)={r3, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r5 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r5, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r4, &(0x7f00000002c0)='snd_aloop.0', 0xb)
syz_usb_control_io(r1, 0x0, 0x0)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r4 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-syz_open_dev$sndpcmc
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r3 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc2604111, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$SNDRV_PCM_IOCTL_HW_PARAMS-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
r4 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, 0x0)
write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-openat-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-bpf$PROG_LOAD-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
fsopen(0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(0xffffffffffffffff, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-fsopen-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
fsopen(0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-ioctl$LOOP_CHANGE_FD-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-ioctl$LOOP_CONFIGURE-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = syz_open_dev$loop(0x0, 0x7, 0x10c062)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x19, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}})
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r3, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat$sysfs-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$loop(0x0, 0x7, 0x10c062)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xc8901, 0x196)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-syz_open_dev$loop-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
syz_open_dev$loop(0x0, 0x7, 0x10c062)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mkdirat-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-bpf$MAP_CREATE-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$inet_MCAST_MSFILTER-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x20000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r1, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402312073f00000000000109022400010000a00009040000020300020009210000000122370009058103"], 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(0x0, 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
program did not crash
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
program did not crash
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
program did not crash
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-mkdirat-mount-openat-syz_open_dev$sndpcmc-write
detailed listing:
executing program 0:
syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/platform/devices/snd_aloop.0/driver/unbind\x00', 0x1, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2)
write(r0, &(0x7f00000002c0)='snd_aloop.0', 0xb)

program crashed: INFO: task hung in trigger_card_free
validation run: crashed=true
reproducing took 3h16m4.673606959s
repro crashed as (corrupted=false):
INFO: task syz.0.17:5819 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:25112 pid:5819  tgid:5819  ppid:5730   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5520 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7270
 __schedule_loop kernel/sched/core.c:7347 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7362
 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
 snd_card_free sound/core/init.c:665 [inline]
 trigger_card_free+0x127/0x190 sound/core/init.c:868
 release_nodes+0xa5/0x120 drivers/base/devres.c:546
 devres_release_all+0x112/0x180 drivers/base/devres.c:576
 device_unbind_cleanup+0x81/0x270 drivers/base/dd.c:597
 __device_release_driver drivers/base/dd.c:1354 [inline]
 device_release_driver_internal+0x4c4/0x620 drivers/base/dd.c:1372
 unbind_store+0xf8/0x110 drivers/base/bus.c:244
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f760b39e0d9
RSP: 002b:00007ffeffd35b18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f760b625fa0 RCX: 00007f760b39e0d9
RDX: 000000000000000b RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007f760b435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f760b625fac R14: 00007f760b625fa0 R15: 00007f760b625fa0
 </TASK>

Showing all locks held in the system:
locks held by khungtaskd/31: 1, last CPU#1:
 #0: ffffffff8ede9d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8ede9d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #0: ffffffff8ede9d40 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6793
locks held by getty/5355: 2, on CPU#1:
 #0: ffff8880334880a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
locks held by syz.0.17/5819: 3, on CPU#0:
 #0: ffff88802a71e460 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
 #1: ffff888079b77880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
 #2: ffff8880330d3138 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #2: ffff8880330d3138 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
 #2: ffff8880330d3138 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 drivers/base/dd.c:1369

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 08 a1 02 e9 43 4f 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 e0 21 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197e00 EFLAGS: 00000242
RAX: 00000000001059fd RBX: ffff88801f29a580 RCX: ffffffff8bc9c115
RDX: 0000000000000001 RSI: ffffffff8e3dfa2f RDI: ffffffff8c619080
RBP: ffffed1003e534b0 R08: 0000000000000001 R09: ffffed10170a678d
R10: ffff8880b8533c6b R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888123c88000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc1bf7eb7c0 CR3: 0000000037feb000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 default_idle+0x9/0x10 arch/x86/kernel/process.c:768
 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x158
 </TASK>

final repro crashed as (corrupted=false):
INFO: task syz.0.17:5819 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:25112 pid:5819  tgid:5819  ppid:5730   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5520 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7270
 __schedule_loop kernel/sched/core.c:7347 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7362
 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
 snd_card_free sound/core/init.c:665 [inline]
 trigger_card_free+0x127/0x190 sound/core/init.c:868
 release_nodes+0xa5/0x120 drivers/base/devres.c:546
 devres_release_all+0x112/0x180 drivers/base/devres.c:576
 device_unbind_cleanup+0x81/0x270 drivers/base/dd.c:597
 __device_release_driver drivers/base/dd.c:1354 [inline]
 device_release_driver_internal+0x4c4/0x620 drivers/base/dd.c:1372
 unbind_store+0xf8/0x110 drivers/base/bus.c:244
 drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f760b39e0d9
RSP: 002b:00007ffeffd35b18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f760b625fa0 RCX: 00007f760b39e0d9
RDX: 000000000000000b RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007f760b435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f760b625fac R14: 00007f760b625fa0 R15: 00007f760b625fa0
 </TASK>

Showing all locks held in the system:
locks held by khungtaskd/31: 1, last CPU#1:
 #0: ffffffff8ede9d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8ede9d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #0: ffffffff8ede9d40 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6793
locks held by getty/5355: 2, on CPU#1:
 #0: ffff8880334880a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
locks held by syz.0.17/5819: 3, on CPU#0:
 #0: ffff88802a71e460 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
 #1: ffff888079b77880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
 #2: ffff8880330d3138 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #2: ffff8880330d3138 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
 #2: ffff8880330d3138 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 drivers/base/dd.c:1369

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: 08 a1 02 e9 43 4f 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 e0 21 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197e00 EFLAGS: 00000242
RAX: 00000000001059fd RBX: ffff88801f29a580 RCX: ffffffff8bc9c115
RDX: 0000000000000001 RSI: ffffffff8e3dfa2f RDI: ffffffff8c619080
RBP: ffffed1003e534b0 R08: 0000000000000001 R09: ffffed10170a678d
R10: ffff8880b8533c6b R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888123c88000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc1bf7eb7c0 CR3: 0000000037feb000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 default_idle+0x9/0x10 arch/x86/kernel/process.c:768
 default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x3ae/0x5b0 kernel/sched/idle.c:355
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:454
 start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x158
 </TASK>