Extracting prog: 5m21.297601735s
Minimizing prog: 45m39.419780532s
Simplifying prog options: 0s
Extracting C: 3m57.1847994s
Simplifying C: 11m50.993160642s


extracting reproducer from 32 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
single: failed to extract reproducer
bisect: bisecting 32 programs with base timeout 30s
testing program (duration=38s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 21, 4, 10, 22, 12, 2, 7, 8, 4, 15, 9, 21, 12, 12, 22, 13, 13, 13, 22, 4, 12, 7, 4, 11, 28, 10, 7, 3, 4, 10, 6]
detailed listing:
executing program 0:
r0 = syz_usbip_server_init(0x3)
read(r0, &(0x7f0000000040)=""/48, 0x30)
write(r0, &(0x7f0000000080)="0000000300000001000000000000000000000000000000000000004000"/48, 0x30)
shutdown(r0, 0x0)
nanosleep(&(0x7f0000000000)={0x1}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='add 1-1', 0x7)
write(r0, &(0x7f0000000180)='add 2-1\x00', 0x8)
write(r0, &(0x7f00000001c0)='add 3-1\x00', 0x8)
write(r0, &(0x7f0000000200)='add 4-1\x00', 0x8)
write(r0, &(0x7f0000000240)='add 5-1\x00', 0x8)
write(r0, &(0x7f0000000280)='add 6-1\x00', 0x8)
write(r0, &(0x7f00000002c0)='add 7-1\x00', 0x8)
write(r0, &(0x7f0000000300)='add 8-1\x00', 0x8)
write(r0, &(0x7f0000000340)='add 1-2\x00', 0x8)
write(r0, &(0x7f0000000380)='add 2-2\x00', 0x8)
write(r0, &(0x7f00000003c0)='add 3-2\x00', 0x8)
write(r0, &(0x7f0000000400)='add 4-2\x00', 0x8)
write(r0, &(0x7f0000000440)='add 5-2\x00', 0x8)
write(r0, &(0x7f0000000480)='add 6-2\x00', 0x8)
write(r0, &(0x7f00000004c0)='add 7-2\x00', 0x8)
write(r0, &(0x7f0000000500)='add 8-2\x00', 0x8)
syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="1201000029be0008110700096ffa010203010902240001000000000904970002ffffff000905041020000637460905de24"], 0x0)
nanosleep(&(0x7f0000000580)={0x1}, 0x0)
executing program 3:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xc8, 0x12b000)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000100)={{0x80000007, 0x3, 0x8, 0x3ae67963, 'syz1\x00', 0xe}, 0x4, 0x200, 0x5, 0x0, 0x0, 0xc9, 'syz1\x00', 0x0})
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dbg\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dbg\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dbg/failslab/times\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='100\x00', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dbg/failslab/space\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='0\x00', 0x1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./dbg/failslab/probability\x00', 0x1, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
write(r2, &(0x7f0000000100)='100\x00', 0x3)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='0x0104\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f00000002c0)='1234567890\x00', 0xb)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='Linux Foundation\x00', 0x11)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)='Test Gadget\x00', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff)
executing program 3:
mkdir(&(0x7f0000000000)='./my_config\x00', 0x1ff)
mkdir(&(0x7f0000000300)='./my_config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='./my_config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='./my_config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffff9c, &(0x7f0000000600)='./my_config/usb_gadget/g1/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='0\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000900)='0\x00', 0x2)
r1 = openat(0xffffff9c, &(0x7f0000000a00)='./my_config/usb_gadget/g1/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='0\x00', 0x2)
symlink(&(0x7f0000000e00)='./my_config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000f00)='./my_config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r2 = openat(0xffffff9c, &(0x7f0000001000)='./my_config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001100)='dummy_udc.0\n\x00', 0xc)
executing program 4:
r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
write(r0, &(0x7f0000000080)='transport=loop,nqn=n', 0x14)
executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0x1000, 0x1000})
ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x1000, 0x1000, 0x1})
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000040)={0x1000, 0x1000})
ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000000c0)={0x1000, 0x1000})
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff)
mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./my_configfs/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./my_configfs/usb_gadget/g1/functions\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./my_configfs/usb_gadget/g1/functions/uvc.usb0/control/terminal/output/default/iTerminal\x00', 0x0, 0x0)
read(r0, &(0x7f0000000900), 0x64)
executing program 0:
mkdir(&(0x7f0000000000)='./my_tracefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./my_tracefs\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_tracefs/trace_marker\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='wip\x00', 0x4)
executing program 4:
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7)
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='ffffffff', 0x8)
close(r0)
syz_usbip_server_init(0x5)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0xf, 0x2)
ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000200)={0x23, 0x3, 0x8, 0x1, 0x0, 0x3e8, &(0x7f0000000240)})
ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000280)={0x23, 0x1, 0x8, 0x1, 0x0, 0x3e8, &(0x7f00000002c0)})
ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000300)={0xa3, 0x0, 0x0, 0x1, 0x4, 0x3e8, &(0x7f0000000340)='\x00\x00\x00\x00'})
r2 = syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x2)
ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000400)={0x23, 0x3, 0x8, 0x1, 0x0, 0x3e8, &(0x7f0000000440)})
ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000480)={0x23, 0x1, 0x8, 0x1, 0x0, 0x3e8, &(0x7f00000004c0)})
ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000500)={0xa3, 0x0, 0x0, 0x1, 0x4, 0x3e8, &(0x7f0000000540)='\x00\x00\x00\x00'})
executing program 0:
mount$overlay(0x0, 0x0, 0x0, 0x8, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000004c0)={[0x8aba, 0x100d, 0x4, 0x804, 0x7ffd, 0xf, 0x120000, 0x9, 0x1, 0x100000001, 0x8000000000000000, 0x1, 0x1, 0xfb, 0x3, 0x1], 0x41000, 0x141200})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000100)=@x86={0x8, 0x12, 0x50, 0x0, 0x20000008, 0x7, 0x5, 0x9, 0x1, 0x8, 0x0, 0x0, 0x0, 0x40004, 0x14, 0xfe, 0xa, 0x80, 0xf, '\x00', 0x2, 0x4080000000000005})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000200)=0x3)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='add 1-1\x00', 0x8)
write(r0, 0x0, 0x0)
write(r0, &(0x7f00000001c0)='add 3-1\x00', 0x8)
write(r0, &(0x7f0000000200)='add 4-1\x00', 0x8)
write(r0, &(0x7f0000000240)='add 5-1\x00', 0x8)
write(r0, &(0x7f0000000280)='add 6-1\x00', 0x8)
write(r0, &(0x7f00000002c0)='add 7-1\x00', 0x8)
write(r0, &(0x7f0000000300)='add 8-1\x00', 0x8)
write(r0, &(0x7f0000000340)='add 1-2\x00', 0x8)
write(r0, &(0x7f0000000380)='add 2-2\x00', 0x8)
write(r0, &(0x7f00000003c0)='add 3-2\x00', 0x8)
write(r0, &(0x7f0000000400)='add 4-2\x00', 0x8)
write(r0, &(0x7f0000000440)='add 5-2\x00', 0x8)
write(r0, &(0x7f0000000480)='add 6-2\x00', 0x8)
write(r0, &(0x7f00000004c0)='add 7-2\x00', 0x8)
write(r0, &(0x7f0000000500)='add 8-2\x00', 0x8)
syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="1201000029be0008110700096ffa010203010902240001000000000904970002ffffff000905041020000637460905de24"], 0x0)
nanosleep(&(0x7f0000000580)={0x1}, 0x0)
executing program 4:
mkdir(&(0x7f0000000000)='./my_config\x00', 0x1ff)
mkdir(&(0x7f0000000300)='./my_config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='./my_config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='./my_config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff)
r0 = openat(0xffffff9c, &(0x7f0000000600)='./my_config/usb_gadget/g1/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='0\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000900)='0\x00', 0x2)
r1 = openat(0xffffff9c, &(0x7f0000000a00)='./my_config/usb_gadget/g1/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='0\x00', 0x2)
symlink(&(0x7f0000000e00)='./my_config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000f00)='./my_config/usb_gadget/g1/configs/c.1/uac2.usb0\x00')
r2 = openat(0xffffff9c, &(0x7f0000001000)='./my_config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000001100)='dummy_udc.0\n\x00', 0xc)
executing program 3:
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7)
mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='ffffffff', 0x8)
close(r0)
syz_usbip_server_init(0x5)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0xf, 0x2)
ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000200)={0x23, 0x3, 0x8, 0x1, 0x0, 0x3e8, &(0x7f0000000240)})
ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000280)={0x23, 0x1, 0x8, 0x1, 0x0, 0x3e8, &(0x7f00000002c0)})
ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000300)={0xa3, 0x0, 0x0, 0x1, 0x4, 0x3e8, &(0x7f0000000340)='\x00\x00\x00\x00'})
syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x2)
executing program 4:
r0 = syz_io_uring_setup(0xf00, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000140)=<r1=>0x0, &(0x7f0000000180)=<r2=>0x0, &(0x7f00000001c0)=<r3=>0x0)
syz_io_uring_modify_offsets$flags(r1, r2, 0x38, 0x1)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f0000000280)={0x42}, &(0x7f00000002c0)='./file1\x00', 0x18, 0x0, 0x12345})
io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0)
r4 = syz_io_uring_complete(r1, r2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs_dir\x00', 0x1ff)
mount(&(0x7f0000000340)=@filename='nodev\x00', &(0x7f0000000380)='./tracefs_dir\x00', &(0x7f00000003c0)='tracefs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x1, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./tracefs_dir/trace\x00', 0x0, 0x0)
r8 = syz_io_uring_setup(0xf00, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000540)=<r9=>0x0, &(0x7f0000000580)=<r10=>0x0, &(0x7f00000005c0)=<r11=>0x0)
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000600)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r5, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)='100\x00', 0x4}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000700)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r5, 0x0, &(0x7f0000000780)=[{&(0x7f00000007c0)='200\x00', 0x4}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000800)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r5, 0x0, &(0x7f0000000880)=[{&(0x7f00000008c0)='300\x00', 0x4}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000900)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r5, 0x0, &(0x7f0000000980)=[{&(0x7f00000009c0)='400\x00', 0x4}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000a00)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r6, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)='8\x00', 0x2}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000b00)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r6, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000bc0)='16\x00', 0x3}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r8, 0x6, 0x0, 0x0, 0x0, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0xf4240}, 0x0)
close(r7)
close(r5)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$kcm(0x11, 0x3, 0x0)
r2 = socket$unix(0x1, 0x5, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x40480, 0x0)
close(r3)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x3, 0x7fffffff, 0x635d, 0x5, 0x80, 0x407}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffffd, 0x101}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r6=>0x0})
setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56)
sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x300, r6, 0x3e}, 0x80, &(0x7f0000003600)=[{&(0x7f0000000180)="27030200590214000600006fb96dbcf706e10500000086ddffff1144ee1611", 0x1f}, {&(0x7f0000000f00)="0b676ae7ce0aa301d6ff23b6557b3e02be56268cb67cc8df76c62092c9dc73bf02e2fbfd0d14f594db9a8faca2d1ee15bc4c2c588479eb0b462fed8714ae90e42c4c1477864b7c37d96279e5c380cb5f53b2983f7e1ec1fb074a8d4be7374be1c9b65b8587e435b5dc319cd5d25258ed81710608c0331449192c63736d71c7fbb72bd9ef8a3be726b464f445638ea32879fe12b88ebe8e141ba4b0efe8ae02c225a3c07cbd1c65a5f9a57267f88213743ea2ab323a2f8f1c50ecca7b6ee9a0fea79147e75e0eca42d7cf6d4d9a1e658e44cd8dc36a7b91cca77237962b41d760dd6e3aed631486ad0f453ef4501e60f923d992103a3845a67fca331897cac2bd51790acf2661efa41d90eda2061ce1aa53cbeab80229844f3954fe9ac6447af516907739ea3e6bbb832770194e6e655ec3a7ab80374b17059080c1fa21970d0147401a1ca1e58e3c86d77d116f4208299d7a3665898b2009c3752c786e4b45042b51366a133974ec564c9d2f0d7cbad234223a19b52e0efeccd654fd2bdd57df81cd7b478ef2b59f8446075d812f9d62e63d1b38375765aa7d63965484ef4d9b0b90ec00b39ac0430cbfee05cd73c34ad9922f50292d69194220339e3c923a9121d0e5ab3b7fc0bc6a33cc87d4cc23eb205848aa1febd8dd07bc25978ee5c6f83db659433b6187af151b76870a994fe4440c46b27fc4fae2e4ed9d711e652e6c397ccd89fc7181d168405d21d9f218508d0af65af34d43b95a83cdeb6a2bed82a8b75dcd514403aa7201818b9a0b5fe9c6ef1ce91bb73a66ee7c1a9a66b736f5556eb0d06ddef99bd96b0e9385db94623bbb509536211963e9", 0x259}], 0x2}, 0x0)
executing program 3:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e24, 0xfffffffa, @empty, 0x8001}, 0x1c)
listen(r1, 0x0)
sendmmsg$inet(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10, 0x0}}], 0x1, 0x2000c000)
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
listen(r2, 0x7d4165c9)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r3, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040)
executing program 32:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket$kcm(0x11, 0x3, 0x0)
r2 = socket$unix(0x1, 0x5, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x40480, 0x0)
close(r3)
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x3, 0x7fffffff, 0x635d, 0x5, 0x80, 0x407}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffffd, 0x101}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', <r6=>0x0})
setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56)
sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x300, r6, 0x3e}, 0x80, &(0x7f0000003600)=[{&(0x7f0000000180)="27030200590214000600006fb96dbcf706e10500000086ddffff1144ee1611", 0x1f}, {&(0x7f0000000f00)="0b676ae7ce0aa301d6ff23b6557b3e02be56268cb67cc8df76c62092c9dc73bf02e2fbfd0d14f594db9a8faca2d1ee15bc4c2c588479eb0b462fed8714ae90e42c4c1477864b7c37d96279e5c380cb5f53b2983f7e1ec1fb074a8d4be7374be1c9b65b8587e435b5dc319cd5d25258ed81710608c0331449192c63736d71c7fbb72bd9ef8a3be726b464f445638ea32879fe12b88ebe8e141ba4b0efe8ae02c225a3c07cbd1c65a5f9a57267f88213743ea2ab323a2f8f1c50ecca7b6ee9a0fea79147e75e0eca42d7cf6d4d9a1e658e44cd8dc36a7b91cca77237962b41d760dd6e3aed631486ad0f453ef4501e60f923d992103a3845a67fca331897cac2bd51790acf2661efa41d90eda2061ce1aa53cbeab80229844f3954fe9ac6447af516907739ea3e6bbb832770194e6e655ec3a7ab80374b17059080c1fa21970d0147401a1ca1e58e3c86d77d116f4208299d7a3665898b2009c3752c786e4b45042b51366a133974ec564c9d2f0d7cbad234223a19b52e0efeccd654fd2bdd57df81cd7b478ef2b59f8446075d812f9d62e63d1b38375765aa7d63965484ef4d9b0b90ec00b39ac0430cbfee05cd73c34ad9922f50292d69194220339e3c923a9121d0e5ab3b7fc0bc6a33cc87d4cc23eb205848aa1febd8dd07bc25978ee5c6f83db659433b6187af151b76870a994fe4440c46b27fc4fae2e4ed9d711e652e6c397ccd89fc7181d168405d21d9f218508d0af65af34d43b95a83cdeb6a2bed82a8b75dcd514403aa7201818b9a0b5fe9c6ef1ce91bb73a66ee7c1a9a66b736f5556eb0d06ddef99bd96b0e9385db94623bbb509536211963e9", 0x259}], 0x2}, 0x0)
executing program 33:
r0 = syz_io_uring_setup(0xf00, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000140)=<r1=>0x0, &(0x7f0000000180)=<r2=>0x0, &(0x7f00000001c0)=<r3=>0x0)
syz_io_uring_modify_offsets$flags(r1, r2, 0x38, 0x1)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000200)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f0000000280)={0x42}, &(0x7f00000002c0)='./file1\x00', 0x18, 0x0, 0x12345})
io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0)
r4 = syz_io_uring_complete(r1, r2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs_dir\x00', 0x1ff)
mount(&(0x7f0000000340)=@filename='nodev\x00', &(0x7f0000000380)='./tracefs_dir\x00', &(0x7f00000003c0)='tracefs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x1, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./tracefs_dir/trace\x00', 0x0, 0x0)
r8 = syz_io_uring_setup(0xf00, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000540)=<r9=>0x0, &(0x7f0000000580)=<r10=>0x0, &(0x7f00000005c0)=<r11=>0x0)
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000600)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r5, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)='100\x00', 0x4}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000700)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r5, 0x0, &(0x7f0000000780)=[{&(0x7f00000007c0)='200\x00', 0x4}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000800)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r5, 0x0, &(0x7f0000000880)=[{&(0x7f00000008c0)='300\x00', 0x4}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000900)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r5, 0x0, &(0x7f0000000980)=[{&(0x7f00000009c0)='400\x00', 0x4}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000a00)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r6, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)='8\x00', 0x2}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
syz_io_uring_submit(r9, r10, r11, &(0x7f0000000b00)=@IORING_OP_WRITE={0x17, 0x10, 0x0, @fd=r6, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000bc0)='16\x00', 0x3}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r8, 0x6, 0x0, 0x0, 0x0, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0xf4240}, 0x0)
close(r7)
close(r5)
executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101042, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100))
ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000240)={0x1, &(0x7f0000000140)=[{0x6, 0x1, 0xfb, 0x2}]})
write(r0, &(0x7f0000000280)="73a39012", 0x4)
executing program 1:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff)
mkdir(&(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff)
symlink(&(0x7f0000000600)='./config/usb_gadget/g1/functions/ncm.usb0\x00', &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r0, &(0x7f0000000900)='dummy_udc.0', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='\n', 0x1)
close(r1)
executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59)
connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28)
r1 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000900)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf00d7815e381ad6e706033a0093b837dc6cc01e32efaec8c7a6ec08123d000200354001060400446b9bbc7a46e3988285dcdf12f21308f868fece01951fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/platform/devices/usbip-vudc.0/modalias\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200)=""/256, 0x100)
executing program 1:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0000}]})
r1 = getpid()
r2 = syz_pidfd_open(r1, 0x0)
setns(r2, 0x24020000)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
mount(0x0, &(0x7f0000000340)='./proc/fs/nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/fs/nfsd/portlist\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='tcp 2', 0x5)
umount2(&(0x7f0000000140)='.\x00', 0x2)
close_range(r0, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x4000000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
mkdir(&(0x7f0000000100)='./sys_mount\x00', 0x1ff)
mount(&(0x7f0000000140)=@filename='sysfs\x00', &(0x7f0000000180)='./sys_mount\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, &(0x7f0000000200))
r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys_mount/block/loop0/queue/rotational\x00', 0x2, 0x0)
write(r2, &(0x7f0000000280)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys_mount/block/loop0/queue/scheduler\x00', 0x2, 0x0)
write(r3, &(0x7f0000000300)='bfq\n\x00', 0x4)
r4 = syz_io_uring_setup(0xf00, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000003c0)=<r5=>0x0, &(0x7f0000000400)=<r6=>0x0, &(0x7f0000000440)=<r7=>0x0)
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000480)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x100000, &(0x7f0000000500), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000540)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000580)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x101000, &(0x7f0000000600), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000640)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000680)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x102000, &(0x7f0000000700), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000740)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000780)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x103000, &(0x7f0000000800), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000840)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000880)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x104000, &(0x7f0000000900), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000940)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000980)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x105000, &(0x7f0000000a00), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000a40)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000a80)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x106000, &(0x7f0000000b00), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000b40)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000b80)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x107000, &(0x7f0000000c00), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000c40)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000c80)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x108000, &(0x7f0000000d00), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000d40)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000d80)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x109000, &(0x7f0000000e00), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000e40)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000e80)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x10a000, &(0x7f0000000f00), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000f40)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000000f80)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x10b000, &(0x7f0000001000), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000001040)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000001080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x10c000, &(0x7f0000001100), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000001140)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000001180)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x10d000, &(0x7f0000001200), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000001240)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000001280)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x10e000, &(0x7f0000001300), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000001340)}})
syz_io_uring_submit(r5, r6, r7, &(0x7f0000001380)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x10f000, &(0x7f0000001400), 0x1000, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000001440)}})
io_uring_enter(r4, 0x10, 0x10, 0x1, 0x0, 0x0)
executing program 2:
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="80000000ffffffffffffffffffffffff50505050505000000000000000000000640001000006020202020202010196050302b00f2503f14760"], 0x55)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0xfffffffe, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x4004800)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_ASSOCIATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0x3c, r4, 0x1, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x96c}], @NL80211_ATTR_MAC={0xa}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000815}, 0x850)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0)
r0 = socket(0x10, 0x3, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
setregid(0xffffffffffffffff, r1)
setgroups(0x0, 0x0)
chmod(&(0x7f0000000180)='./file0\x00', 0x0)
executing program 2:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0))
readv(r0, &(0x7f0000000640)=[{&(0x7f0000000480)=""/206, 0xce}], 0x1)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/machinecheck/machinecheck0/check_interval\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='300\n\x00', 0x4)
executing program 2:
syz_open_dev$loop(0x0, 0x760, 0xa382)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000380)=""/4090, 0xffa}], 0x1, 0xa, 0x203)
bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
fsmount(0xffffffffffffffff, 0x0, 0x8)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fab000/0x18000)=nil, &(0x7f0000001440)=[@textreal={0x8, 0x0}], 0x1, 0x11, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000000))
executing program 2:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program crashed: WARNING in virtio_dev_remove
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
pwrite64(0xffffffffffffffff, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(0x0, 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program crashed: WARNING in virtio_dev_remove
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, 0x0, 0x0, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180), 0x0, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
program crashed: WARNING in virtio_dev_remove
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
program crashed: WARNING in virtio_dev_remove
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
program crashed: WARNING in virtio_dev_remove
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
program crashed: WARNING in virtio_dev_remove
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
program crashed: WARNING in virtio_dev_remove
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
program crashed: WARNING in virtio_dev_remove
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
program crashed: WARNING in virtio_dev_remove
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
program crashed: WARNING in virtio_dev_remove
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program crashed: WARNING in virtio_dev_remove
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program crashed: WARNING in virtio_dev_remove
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write
detailed listing:
executing program 0:
mkdir(&(0x7f0000000040)='sys\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0)
pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)

program crashed: WARNING in virtio_dev_remove
validation run: crashed=true
reproducing took 1h14m24.436209826s
repro crashed as (corrupted=false):
------------[ cut here ]------------
dev->config->get_status(dev)
WARNING: drivers/virtio/virtio.c:378 at virtio_dev_remove+0x18b/0x1b0 drivers/virtio/virtio.c:378, CPU#1: syz.0.17/5947
Modules linked in:
CPU: 1 UID: 0 PID: 5947 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:virtio_dev_remove+0x18b/0x1b0 drivers/virtio/virtio.c:378
Code: 4c 89 f7 2e 2e 2e 41 ff d3 0c 01 0f b6 f0 4c 89 f7 4d 89 fb 5b 41 5c 41 5d 41 5e 41 5f 5d 2e e9 cb 7e c1 1a e8 96 50 87 fc 90 <0f> 0b 90 e9 6e ff ff ff 44 89 e9 80 e1 07 38 c1 0f 8c c2 fe ff ff
RSP: 0018:ffffc90003b277d8 EFLAGS: 00010293
RAX: ffffffff853e8a5a RBX: ffff8880207806d0 RCX: ffff888030915d00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000000000ff R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8540e710 R12: 1ffff110040f00da
R13: dffffc0000000000 R14: ffff888020780000 R15: ffffffff8bd67c98
FS:  000055556e68a500(0000) GS:ffff888125d41000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005608435e0950 CR3: 0000000045076000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 device_remove drivers/base/dd.c:616 [inline]
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
 bus_remove_device+0x449/0x560 drivers/base/bus.c:664
 device_del+0x528/0x8f0 drivers/base/core.c:3961
 device_unregister+0x21/0xf0 drivers/base/core.c:4002
 unregister_virtio_device+0x37/0x60 drivers/virtio/virtio.c:594
 virtio_pci_remove+0x7f/0xf0 drivers/virtio/virtio_pci_common.c:758
 pci_device_remove+0x99/0x1c0 drivers/pci/pci-driver.c:512
 device_remove drivers/base/dd.c:616 [inline]
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
 pci_stop_dev drivers/pci/remove.c:27 [inline]
 pci_stop_bus_device+0xf6/0x120 drivers/pci/remove.c:93
 pci_stop_and_remove_bus_device drivers/pci/remove.c:128 [inline]
 pci_stop_and_remove_bus_device_locked+0x77/0xb0 drivers/pci/remove.c:136
 remove_store+0xe5/0x150 drivers/pci/pci-sysfs.c:523
 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbb86b2df99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff3c76f378 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fbb86db5fa0 RCX: 00007fbb86b2df99
RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000004
RBP: 00007fbb86bc4ec4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbb86db5fac R14: 00007fbb86db5fa0 R15: 00007fbb86db5fa0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
dev->config->get_status(dev)
WARNING: drivers/virtio/virtio.c:378 at virtio_dev_remove+0x18b/0x1b0 drivers/virtio/virtio.c:378, CPU#1: syz.0.17/5947
Modules linked in:
CPU: 1 UID: 0 PID: 5947 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:virtio_dev_remove+0x18b/0x1b0 drivers/virtio/virtio.c:378
Code: 4c 89 f7 2e 2e 2e 41 ff d3 0c 01 0f b6 f0 4c 89 f7 4d 89 fb 5b 41 5c 41 5d 41 5e 41 5f 5d 2e e9 cb 7e c1 1a e8 96 50 87 fc 90 <0f> 0b 90 e9 6e ff ff ff 44 89 e9 80 e1 07 38 c1 0f 8c c2 fe ff ff
RSP: 0018:ffffc90003b277d8 EFLAGS: 00010293
RAX: ffffffff853e8a5a RBX: ffff8880207806d0 RCX: ffff888030915d00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000000000ff R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8540e710 R12: 1ffff110040f00da
R13: dffffc0000000000 R14: ffff888020780000 R15: ffffffff8bd67c98
FS:  000055556e68a500(0000) GS:ffff888125d41000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005608435e0950 CR3: 0000000045076000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 device_remove drivers/base/dd.c:616 [inline]
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
 bus_remove_device+0x449/0x560 drivers/base/bus.c:664
 device_del+0x528/0x8f0 drivers/base/core.c:3961
 device_unregister+0x21/0xf0 drivers/base/core.c:4002
 unregister_virtio_device+0x37/0x60 drivers/virtio/virtio.c:594
 virtio_pci_remove+0x7f/0xf0 drivers/virtio/virtio_pci_common.c:758
 pci_device_remove+0x99/0x1c0 drivers/pci/pci-driver.c:512
 device_remove drivers/base/dd.c:616 [inline]
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
 pci_stop_dev drivers/pci/remove.c:27 [inline]
 pci_stop_bus_device+0xf6/0x120 drivers/pci/remove.c:93
 pci_stop_and_remove_bus_device drivers/pci/remove.c:128 [inline]
 pci_stop_and_remove_bus_device_locked+0x77/0xb0 drivers/pci/remove.c:136
 remove_store+0xe5/0x150 drivers/pci/pci-sysfs.c:523
 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbb86b2df99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff3c76f378 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fbb86db5fa0 RCX: 00007fbb86b2df99
RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000004
RBP: 00007fbb86bc4ec4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbb86db5fac R14: 00007fbb86db5fa0 R15: 00007fbb86db5fa0
 </TASK>