Extracting prog: 27m24.460708476s Minimizing prog: 26m22.812709785s Simplifying prog options: 9m1.203831168s Extracting C: 1m17.836388491s Simplifying C: 0s extracting reproducer from 26 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-execve-socket$inet6-bind$inet6-socket$inet6-bind$inet6 detailed listing: executing program 0: mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e20, 0x440007, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8a6}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8}, 0x1c) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_smc-setsockopt$inet_buf-setsockopt$sock_int-connect$inet-syz_clone3-syz_clone3 detailed listing: executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000300)=0x3, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f000000dd80)={0xa04400, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_icmp_raw-connect$inet6-openat$cgroup_ro-write$binfmt_script-mprotect-sendfile detailed listing: executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x87) connect$inet6(r0, &(0x7f0000000500)={0xa, 0xfffd, 0x2, @local, 0x6}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000440), 0x1000a) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendfile(r0, r1, &(0x7f0000000080)=0x11, 0xffff) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-setsockopt$sock_int-bind$inet6-connect$inet6-setsockopt$SO_BINDTODEVICE-sendmmsg$inet detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000040)=0x6, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x2006}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x4c}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='vlan0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000002680)=[{{0x0, 0x0, &(0x7f0000003e40)=[{&(0x7f0000000cc0)="01562db1d027d65d0ee6dce1905b044d7812c979bed95e7832eb61f4bc9643e0f6084cefff0acb09b3028b646bc8513fc0289afdb8e024c746c69c20bedc1961858af6f1a4d732205066012769afcab13859bf1b9524aeed391c4745ce27f553da682de74851a6a31a025656a93357842c0445c3231ba92ede7a6e00497f08e013e7c218da0196e479345958c235180bfc46425867de9cdfc65ac580a66025b78ad442d25ec048178ae2affe0b31ba3d2d09f37c6dc7c3ff3f75f634b146cd652592e9ecb3a73da0f4c06bf5e5f7b93e5a0f4ca1281ecf03feb60cfa76542c4d20ab3d630679e9a361296b2693a6da155ba2d6b2b1dea412773225dcab91511946574a3a34554e42db14f9cb3060ede816838ad88d83f6cd1c7a176e51adfd39cfd2326d5d804adc4da5c43a7a89c578fc160837a8d1e366b868cbd27e6b98407784efffee31724a70c6811fd5c0dbec2eab77efb7c844bccbc1e496b4aa501b603e930e70b54477ffe6ae3a6250f12757a7849b480f5922a44304ed59b2d4fdd2a3ea10dcad20fcbbc426e636cc29d7ec0c37361ea13265359ca6fe6bedc4cbcef0caf68538d0bed1d60e6a57b06b901f0ff0ff8264ca7643f5acafae890e57f73579072d8caf1250486a393ee79b3352175f935f653388a809e64a23ec9927522fcf32776f7341f8f2cdc67633b66f6bd79e6a0eebd7e3655c13a4122a72be2ce6c112cebba9588d83013037a60878d076ecc84a757779c1589ec9a8f36096580be23ce18eaab848e2b581fde2cb1f4528d75d15377f42bdfdef5305dc9ee794d2926fa8640b2b8521c6a742bd8acae71478455d8a506c78c5aa63b411d1dd425b5c47178d2552a2a8a275f2b9f7c92d29b852e7ce2d766261db6bd0a530e72fa39683a614180d2530a76fb5abf195256ca1a2f0007566c358e4e5c24f2eae61e2fedc0d50c282cc37c310ad369efd248e0b5f1a332609da191cdc914d0346f84cf639512807e578994c55e2060e3b5c3cf89d22d6bb8d8cbf48b3b846c7af1b152f3995f54aadbc0162a8803cf8956d94873711134e3a9bbd7373269bea4044adaafd2a570362c6145b1fd6cd67a0c71f622ed991bbe9cd83b8b377040c2e0bb962a07088156b3a2d4d83c06131baa5a4ad0b5ab192a96f55dd2bd52a30ecca828bddd7ffdae06b292483f9e0f1f98a6b84434e4d77825eaafe723994d7d022324eac9babcd2b807290dac3a2fae860cd34eacb0d5b42cdb916f322eff3c79c609716d232ab7b1c279c55f4951e2dfe38da3e55897ad175f00226da4eec6919146b8fd4634be52d4577baa59e3b5d5ad8d2b5a4520c8d44b0cd78bafd52ff3cb89c7b145fab26f089537e2d83745aed7de83f49aa4aac297d87a608b703e0de464cd54b43d37751b3a57e80e21db4bb534b4ddbc75b7f496200ce964508c785388b0c70e1d22010a928ca23912c094f34ad2c61f5cd465872c409a8e4245fd641268fbb88a40c3138bdf69a12385f456a4cc206a410be7520777170598884e975d7247acef28a9c3d1b535f8c9a9bc469ed99c9afe3403c7fce36ad6c9e1edf4b7d53fff8a505055fdb3519410ca8460ffb992112258e831e3b38cd233852f44209167975c6a324833b14d6ed0e38ef73beac4d527468790c7aa132", 0x49d}], 0x1}}, {{0x0, 0x0, &(0x7f0000002b40)=[{&(0x7f0000000000)='\x00', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000480)='=', 0x1}], 0x1}}], 0x3, 0x119e75c40277adee) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash single: failed to extract reproducer bisect: bisecting 26 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 0: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x82, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000340)=0x8) read$dsp(r0, &(0x7f00000001c0)=""/62, 0x3e) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000000)=0x4) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000180), 0x10) sendmsg$can_bcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="05000000d8000001118006b05c6a8ce2", @ANYRES64, @ANYRES64=0x2710, @ANYRES64=r1, @ANYRES64=0x0, @ANYBLOB="00000080"], 0x48}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="05000000020800"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="00000080"], 0x80}}, 0x800) close_range(r0, 0xffffffffffffffff, 0x0) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0x33) executing program 3: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x528, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x0, 0xfff3}, {0xe, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @initdev={0xac, 0x1e, 0x1, 0x0}}]}}, @filter_kind_options=@f_u32={{0x8}, {0x4e4, 0x2, [@TCA_U32_LINK={0x8, 0x3, 0x4}, @TCA_U32_MARK={0x10, 0xa, {0x4af0, 0x10000}}, @TCA_U32_LINK={0x8, 0x3, 0x6}, @TCA_U32_LINK={0x8, 0x3, 0x8}, @TCA_U32_MARK={0x10, 0xa, {0x6, 0x9}}, @TCA_U32_MARK={0x10, 0xa, {0x8}}, @TCA_U32_LINK={0x8, 0x3, 0x4}, @TCA_U32_ACT={0x490, 0x7, [@m_police={0x48c, 0x5, 0x0, 0x0, {{0xb}, {0x460, 0x2, 0x0, 0x1, [[@TCA_POLICE_AVRATE={0x8, 0x4, 0x4}, @TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x5, 0x3, 0x5, 0x6, {0x9, 0x1, 0x40, 0x3, 0x1, 0x5}, {0x9, 0x2, 0x1, 0x4, 0xffff, 0x6}, 0x3, 0xfffffe01, 0x8000}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7fff}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7, 0xd, 0x200, 0x8, 0x80, 0x20200, 0x2, 0x9, 0xf, 0x8, 0x2, 0x3, 0x5, 0x4, 0xfffffbff, 0xb, 0x7fff, 0x9cdd, 0x3, 0x2, 0x400, 0x8000, 0xfffff001, 0x9, 0x3, 0x2215, 0x3, 0x13, 0x8, 0x3, 0x81, 0x1, 0x7, 0x11b7, 0x3, 0xff, 0x1, 0x6, 0x0, 0xfffffff6, 0x7, 0x1, 0x2, 0xffff226f, 0x96, 0x7, 0xf, 0xf7, 0x6, 0x1, 0xf, 0x7, 0x7, 0x4, 0x517, 0x3, 0x12d, 0x9, 0x2, 0xc, 0x2, 0xffffff60, 0xfffffffb, 0x7, 0xd033, 0x7f, 0x3, 0x1ff, 0xfc000000, 0x4, 0x0, 0xb, 0x5, 0x1, 0x6977c074, 0xffff0000, 0x818, 0x200, 0xfffeffff, 0x9, 0x8000, 0x218, 0x2, 0x40, 0x8, 0x5, 0x9b, 0x6f6cde87, 0x80000001, 0x8, 0x4, 0x8000, 0x4, 0x1, 0x1, 0x2, 0xffffffff, 0xffffffff, 0x8001, 0x5, 0x6, 0xee, 0x1, 0xc, 0x1, 0x25ee1713, 0x7, 0xa8, 0x3, 0x5, 0xfffffff9, 0x2, 0x2, 0x8, 0x8, 0xe, 0x1ff, 0x1252, 0x9, 0x4, 0xf3, 0x0, 0x2, 0x40, 0xbe, 0x3, 0x9, 0xffff031e, 0x1, 0x5, 0x5, 0x3, 0x7fff, 0x8, 0x7, 0x1, 0x5, 0x6, 0xe9d, 0x5, 0x1, 0x1, 0xf, 0x1cb6, 0x0, 0x3, 0x3, 0x40, 0x4, 0x8, 0x8, 0x7ff, 0x7fff, 0x0, 0x2, 0x8001, 0x894, 0x80000001, 0x8, 0x816, 0x8, 0xfffffdb0, 0x5d, 0x6, 0x3, 0x8000, 0xc124, 0x9, 0x8, 0x3, 0x7, 0xfffff000, 0x6, 0x4000, 0x1, 0xa4e, 0xc01, 0x1, 0xfffffffe, 0x6, 0x2, 0x9, 0x9, 0x904, 0x5, 0x401, 0x3, 0x3, 0x8, 0x3ff, 0x0, 0x0, 0x9, 0x4, 0x1, 0x3, 0x8, 0x8e, 0x0, 0x4, 0x1d, 0x0, 0x79a, 0x7fffffff, 0x6, 0x44, 0x8, 0x18f, 0x9, 0x7, 0x200, 0x8, 0x101, 0x81, 0x0, 0x2, 0x2, 0xd3, 0xb77, 0x6, 0xe5, 0x80, 0x299, 0x1, 0xc566, 0x5, 0x6, 0x6, 0x2, 0x7, 0xeadb, 0x6a, 0x3, 0x6, 0x7, 0x80, 0x5, 0x3, 0xa490, 0x339, 0x7, 0x0, 0x63a00, 0x6, 0x3, 0x10, 0x6, 0x7b60331f, 0x5, 0xa, 0x7, 0x7, 0x3, 0x7, 0x3e00, 0x401]}]]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}}]}, 0x528}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="2ff000fea0"], 0x0, 0xb, 0x0, 0x0, 0x41100, 0x6e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x54, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x28, 0x3, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @hash={{0x9}, @val={0x4}}}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) executing program 0: ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0xfffffff4, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x97f, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffbfbbfbe, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, 0x0) executing program 3: r0 = timerfd_create(0x9, 0x80000) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x482, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x7, r1, 0x0}]) timerfd_settime(r0, 0x3, &(0x7f0000000240)={{}, {0x0, 0x989680}}, 0x0) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f0000001ac0)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x9}], 0x1, 0x40000102, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) executing program 1: r0 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mq_unlink(0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$MEMREADOOB64(r0, 0x1269, &(0x7f00000000c0)={0x1}) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x8c66) r3 = eventfd2(0xbd49, 0x800) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0xfffffffffffffc04, 0xd5f4d005, 0x8, r3, 0x11}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x27880000000, 0x0, 0x1, r2, 0x4}) executing program 1: sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) close_range(r2, 0xffffffffffffffff, 0x2) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) executing program 1: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) write$binfmt_script(r0, &(0x7f0000000400)={'#! ', './file0'}, 0xb) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000140)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) sigaltstack(&(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0xfafe}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) executing program 2: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x4, 0xf39, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000480)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0xe1}, 0x0, 0x1, 0x0, 0x0) syz_ublk_process_io(0x0, 0x0, 0x9, 0x0, 0x0) executing program 4: pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r0, 0x407, 0x0) write$FUSE_INIT(r0, &(0x7f0000000200)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x28, 0x2, 0xffffffff82048008, 0x0, 0x40, 0x8, 0x0, 0x0, 0x0, 0x104, 0x8}}, 0x50) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(r0, 0x407, 0x2000000) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, 0x0) executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r0, &(0x7f0000000040)="aa", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x0, 0xfffffffc, @dev={0xfe, 0x80, '\x00', 0x3}, 0x3}, 0x1c) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x8, 0x2, 0x819}, 0x14) executing program 1: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r0 = userfaultfd(0x801) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x8, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) executing program 4: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) socket$rds(0x15, 0x5, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x3e}], 0x16, 0x0, 0x0, 0x40041}, 0x24000000) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x200000, 0x0, 0xff, 0x1}, 0x20) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@mcast2={0xff, 0x5}, 0x200, 0x0, 0x2, 0x3}, 0x20) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_flowlabel\x00') read$FUSE(r2, &(0x7f00000000c0)={0x2020}, 0x2020) executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x5) r1 = eventfd2(0x0, 0x0) io_setup(0x4, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f00000000c0)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0xfffe, r0, 0x0, 0x0, 0x0, 0x0, 0x3, r1}]) shutdown(r0, 0x0) executing program 3: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010020bd70100600010007000000080009000200000008000b"], 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000040)=0x6, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x2006}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x4c}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='vlan0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000002680)=[{{0x0, 0x0, &(0x7f0000003e40)=[{&(0x7f0000000cc0)="01562db1d027d65d0ee6dce1905b044d7812c979bed95e7832eb61f4bc9643e0f6084cefff0acb09b3028b646bc8513fc0289afdb8e024c746c69c20bedc1961858af6f1a4d732205066012769afcab13859bf1b9524aeed391c4745ce27f553da682de74851a6a31a025656a93357842c0445c3231ba92ede7a6e00497f08e013e7c218da0196e479345958c235180bfc46425867de9cdfc65ac580a66025b78ad442d25ec048178ae2affe0b31ba3d2d09f37c6dc7c3ff3f75f634b146cd652592e9ecb3a73da0f4c06bf5e5f7b93e5a0f4ca1281ecf03feb60cfa76542c4d20ab3d630679e9a361296b2693a6da155ba2d6b2b1dea412773225dcab91511946574a3a34554e42db14f9cb3060ede816838ad88d83f6cd1c7a176e51adfd39cfd2326d5d804adc4da5c43a7a89c578fc160837a8d1e366b868cbd27e6b98407784efffee31724a70c6811fd5c0dbec2eab77efb7c844bccbc1e496b4aa501b603e930e70b54477ffe6ae3a6250f12757a7849b480f5922a44304ed59b2d4fdd2a3ea10dcad20fcbbc426e636cc29d7ec0c37361ea13265359ca6fe6bedc4cbcef0caf68538d0bed1d60e6a57b06b901f0ff0ff8264ca7643f5acafae890e57f73579072d8caf1250486a393ee79b3352175f935f653388a809e64a23ec9927522fcf32776f7341f8f2cdc67633b66f6bd79e6a0eebd7e3655c13a4122a72be2ce6c112cebba9588d83013037a60878d076ecc84a757779c1589ec9a8f36096580be23ce18eaab848e2b581fde2cb1f4528d75d15377f42bdfdef5305dc9ee794d2926fa8640b2b8521c6a742bd8acae71478455d8a506c78c5aa63b411d1dd425b5c47178d2552a2a8a275f2b9f7c92d29b852e7ce2d766261db6bd0a530e72fa39683a614180d2530a76fb5abf195256ca1a2f0007566c358e4e5c24f2eae61e2fedc0d50c282cc37c310ad369efd248e0b5f1a332609da191cdc914d0346f84cf639512807e578994c55e2060e3b5c3cf89d22d6bb8d8cbf48b3b846c7af1b152f3995f54aadbc0162a8803cf8956d94873711134e3a9bbd7373269bea4044adaafd2a570362c6145b1fd6cd67a0c71f622ed991bbe9cd83b8b377040c2e0bb962a07088156b3a2d4d83c06131baa5a4ad0b5ab192a96f55dd2bd52a30ecca828bddd7ffdae06b292483f9e0f1f98a6b84434e4d77825eaafe723994d7d022324eac9babcd2b807290dac3a2fae860cd34eacb0d5b42cdb916f322eff3c79c609716d232ab7b1c279c55f4951e2dfe38da3e55897ad175f00226da4eec6919146b8fd4634be52d4577baa59e3b5d5ad8d2b5a4520c8d44b0cd78bafd52ff3cb89c7b145fab26f089537e2d83745aed7de83f49aa4aac297d87a608b703e0de464cd54b43d37751b3a57e80e21db4bb534b4ddbc75b7f496200ce964508c785388b0c70e1d22010a928ca23912c094f34ad2c61f5cd465872c409a8e4245fd641268fbb88a40c3138bdf69a12385f456a4cc206a410be7520777170598884e975d7247acef28a9c3d1b535f8c9a9bc469ed99c9afe3403c7fce36ad6c9e1edf4b7d53fff8a505055fdb3519410ca8460ffb992112258e831e3b38cd233852f44209167975c6a324833b14d6ed0e38ef73beac4d527468790c7aa132", 0x49d}], 0x1}}, {{0x0, 0x0, &(0x7f0000002b40)=[{&(0x7f0000000000)='\x00', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000480)='=', 0x1}], 0x1}}], 0x3, 0x119e75c40277adee) executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x87) connect$inet6(r0, &(0x7f0000000500)={0xa, 0xfffd, 0x2, @local, 0x6}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000440), 0x1000a) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendfile(r0, r1, &(0x7f0000000080)=0x11, 0xffff) executing program 1: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000300)=0x3, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f000000dd80)={0xa04400, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58) executing program 3: mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e20, 0x440007, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8a6}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8}, 0x1c) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-execve-socket$inet6-bind$inet6-socket$inet6-bind$inet6 detailed listing: executing program 0: mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e20, 0x440007, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8a6}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8}, 0x1c) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_smc-setsockopt$inet_buf-setsockopt$sock_int-connect$inet-syz_clone3-syz_clone3 detailed listing: executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000300)=0x3, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f000000dd80)={0xa04400, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_icmp_raw-connect$inet6-openat$cgroup_ro-write$binfmt_script-mprotect-sendfile detailed listing: executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x87) connect$inet6(r0, &(0x7f0000000500)={0xa, 0xfffd, 0x2, @local, 0x6}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='freezer.parent_freezing\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000440), 0x1000a) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendfile(r0, r1, &(0x7f0000000080)=0x11, 0xffff) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-setsockopt$sock_int-bind$inet6-connect$inet6-setsockopt$SO_BINDTODEVICE-sendmmsg$inet detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000040)=0x6, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x2006}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x4c}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='vlan0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000002680)=[{{0x0, 0x0, &(0x7f0000003e40)=[{&(0x7f0000000cc0)="01562db1d027d65d0ee6dce1905b044d7812c979bed95e7832eb61f4bc9643e0f6084cefff0acb09b3028b646bc8513fc0289afdb8e024c746c69c20bedc1961858af6f1a4d732205066012769afcab13859bf1b9524aeed391c4745ce27f553da682de74851a6a31a025656a93357842c0445c3231ba92ede7a6e00497f08e013e7c218da0196e479345958c235180bfc46425867de9cdfc65ac580a66025b78ad442d25ec048178ae2affe0b31ba3d2d09f37c6dc7c3ff3f75f634b146cd652592e9ecb3a73da0f4c06bf5e5f7b93e5a0f4ca1281ecf03feb60cfa76542c4d20ab3d630679e9a361296b2693a6da155ba2d6b2b1dea412773225dcab91511946574a3a34554e42db14f9cb3060ede816838ad88d83f6cd1c7a176e51adfd39cfd2326d5d804adc4da5c43a7a89c578fc160837a8d1e366b868cbd27e6b98407784efffee31724a70c6811fd5c0dbec2eab77efb7c844bccbc1e496b4aa501b603e930e70b54477ffe6ae3a6250f12757a7849b480f5922a44304ed59b2d4fdd2a3ea10dcad20fcbbc426e636cc29d7ec0c37361ea13265359ca6fe6bedc4cbcef0caf68538d0bed1d60e6a57b06b901f0ff0ff8264ca7643f5acafae890e57f73579072d8caf1250486a393ee79b3352175f935f653388a809e64a23ec9927522fcf32776f7341f8f2cdc67633b66f6bd79e6a0eebd7e3655c13a4122a72be2ce6c112cebba9588d83013037a60878d076ecc84a757779c1589ec9a8f36096580be23ce18eaab848e2b581fde2cb1f4528d75d15377f42bdfdef5305dc9ee794d2926fa8640b2b8521c6a742bd8acae71478455d8a506c78c5aa63b411d1dd425b5c47178d2552a2a8a275f2b9f7c92d29b852e7ce2d766261db6bd0a530e72fa39683a614180d2530a76fb5abf195256ca1a2f0007566c358e4e5c24f2eae61e2fedc0d50c282cc37c310ad369efd248e0b5f1a332609da191cdc914d0346f84cf639512807e578994c55e2060e3b5c3cf89d22d6bb8d8cbf48b3b846c7af1b152f3995f54aadbc0162a8803cf8956d94873711134e3a9bbd7373269bea4044adaafd2a570362c6145b1fd6cd67a0c71f622ed991bbe9cd83b8b377040c2e0bb962a07088156b3a2d4d83c06131baa5a4ad0b5ab192a96f55dd2bd52a30ecca828bddd7ffdae06b292483f9e0f1f98a6b84434e4d77825eaafe723994d7d022324eac9babcd2b807290dac3a2fae860cd34eacb0d5b42cdb916f322eff3c79c609716d232ab7b1c279c55f4951e2dfe38da3e55897ad175f00226da4eec6919146b8fd4634be52d4577baa59e3b5d5ad8d2b5a4520c8d44b0cd78bafd52ff3cb89c7b145fab26f089537e2d83745aed7de83f49aa4aac297d87a608b703e0de464cd54b43d37751b3a57e80e21db4bb534b4ddbc75b7f496200ce964508c785388b0c70e1d22010a928ca23912c094f34ad2c61f5cd465872c409a8e4245fd641268fbb88a40c3138bdf69a12385f456a4cc206a410be7520777170598884e975d7247acef28a9c3d1b535f8c9a9bc469ed99c9afe3403c7fce36ad6c9e1edf4b7d53fff8a505055fdb3519410ca8460ffb992112258e831e3b38cd233852f44209167975c6a324833b14d6ed0e38ef73beac4d527468790c7aa132", 0x49d}], 0x1}}, {{0x0, 0x0, &(0x7f0000002b40)=[{&(0x7f0000000000)='\x00', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000480)='=', 0x1}], 0x1}}], 0x3, 0x119e75c40277adee) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: WARNING: ODEBUG bug in corsair_remove single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: WARNING: ODEBUG bug in corsair_remove testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program crashed: WARNING: ODEBUG bug in corsair_remove testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program crashed: WARNING: ODEBUG bug in hid_device_remove testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program crashed: WARNING: ODEBUG bug in corsair_remove extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program crashed: WARNING: ODEBUG bug in corsair_remove extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program crashed: WARNING: ODEBUG bug in hid_device_remove validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program crashed: WARNING: ODEBUG bug in hid_device_remove validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) program crashed: WARNING: ODEBUG bug in corsair_remove validation run: crashed=true reproducing took 1h11m48.671988805s repro crashed as (corrupted=false): corsair 0003:1B1C:1B02.0022: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.0-1/input0 corsair 0003:1B1C:1B02.0022: Failed to get K90 initial state (error -71). usb 1-1: USB disconnect, device number 35 ------------[ cut here ]------------ ODEBUG: free active (active state 0) object: ffff888039d832b8 object type: work_struct hint: k90_record_led_work+0x0/0x1e0 drivers/hid/hid-corsair.c:-1 WARNING: lib/debugobjects.c:632 at debug_print_object+0xec/0x230 lib/debugobjects.c:629, CPU#1: kworker/1:0/31 Modules linked in: CPU: 1 UID: 0 PID: 31 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:debug_print_object+0x18a/0x230 lib/debugobjects.c:629 Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 ad 0d 5b fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 43 39 db 0a 48 83 c4 10 5b 41 5c RSP: 0018:ffffc90000a5efd0 EFLAGS: 00010246 RAX: 1ffffffff16d7068 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffffffff8bcbfb40 RSI: ffffffff8bcbf5c0 RDI: ffffffff8fbc3f50 RBP: ffffffff8bcbfb40 R08: ffff888039d832b8 R09: ffffffff8b6b9560 R10: dffffc0000000000 R11: ffffffff818ed800 R12: 0000000000000000 R13: ffffffff8fbc3f50 R14: ffff888039d832b8 R15: ffffffff8b6b8340 FS: 0000000000000000(0000) GS:ffff888125ce8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd6d27ed40 CR3: 00000000383fc000 CR4: 00000000003526f0 Call Trace: __debug_check_no_obj_freed lib/debugobjects.c:1171 [inline] debug_check_no_obj_freed+0x2e3/0x450 lib/debugobjects.c:1201 slab_free_hook mm/slub.c:2679 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x13e/0x6d0 mm/slub.c:6792 k90_cleanup_macro_functions drivers/hid/hid-corsair.c:547 [inline] corsair_remove+0xfd/0x260 drivers/hid/hid-corsair.c:602 hid_device_remove+0xc8/0x1d0 drivers/hid/hid-core.c:2897 device_remove drivers/base/dd.c:616 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372 bus_remove_device+0x449/0x560 drivers/base/bus.c:664 device_del+0x528/0x8f0 drivers/base/core.c:3965 hid_remove_device drivers/hid/hid-core.c:3126 [inline] hid_destroy_device+0x6b/0x1b0 drivers/hid/hid-core.c:3148 usbhid_disconnect+0x9f/0xc0 drivers/hid/usbhid/hid-core.c:1479 usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:618 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372 bus_remove_device+0x449/0x560 drivers/base/bus.c:664 device_del+0x528/0x8f0 drivers/base/core.c:3965 usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478 usb_disconnect+0x32d/0x990 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5415 [inline] hub_port_connect_change drivers/usb/core/hub.c:5715 [inline] port_event drivers/usb/core/hub.c:5879 [inline] hub_event+0x1bb7/0x4cf0 drivers/usb/core/hub.c:5961 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: f8 clc 1: 48 c1 e8 03 shr $0x3,%rax 5: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) 9: 74 08 je 0x13 b: 4c 89 ff mov %r15,%rdi e: e8 ad 0d 5b fd call 0xfd5b0dc0 13: 4d 8b 0f mov (%r15),%r9 16: 4c 89 ef mov %r13,%rdi 19: 48 8b 74 24 08 mov 0x8(%rsp),%rsi 1e: 48 89 ea mov %rbp,%rdx 21: 44 89 e1 mov %r12d,%ecx 24: 4d 89 f0 mov %r14,%r8 27: ff 34 24 push (%rsp) * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 48 83 c4 08 add $0x8,%rsp 33: ff 05 43 39 db 0a incl 0xadb3943(%rip) # 0xadb397c 39: 48 83 c4 10 add $0x10,%rsp 3d: 5b pop %rbx 3e: 41 5c pop %r12 final repro crashed as (corrupted=false): corsair 0003:1B1C:1B02.0022: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.0-1/input0 corsair 0003:1B1C:1B02.0022: Failed to get K90 initial state (error -71). usb 1-1: USB disconnect, device number 35 ------------[ cut here ]------------ ODEBUG: free active (active state 0) object: ffff888039d832b8 object type: work_struct hint: k90_record_led_work+0x0/0x1e0 drivers/hid/hid-corsair.c:-1 WARNING: lib/debugobjects.c:632 at debug_print_object+0xec/0x230 lib/debugobjects.c:629, CPU#1: kworker/1:0/31 Modules linked in: CPU: 1 UID: 0 PID: 31 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:debug_print_object+0x18a/0x230 lib/debugobjects.c:629 Code: f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 ad 0d 5b fd 4d 8b 0f 4c 89 ef 48 8b 74 24 08 48 89 ea 44 89 e1 4d 89 f0 ff 34 24 <67> 48 0f b9 3a 48 83 c4 08 ff 05 43 39 db 0a 48 83 c4 10 5b 41 5c RSP: 0018:ffffc90000a5efd0 EFLAGS: 00010246 RAX: 1ffffffff16d7068 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffffffff8bcbfb40 RSI: ffffffff8bcbf5c0 RDI: ffffffff8fbc3f50 RBP: ffffffff8bcbfb40 R08: ffff888039d832b8 R09: ffffffff8b6b9560 R10: dffffc0000000000 R11: ffffffff818ed800 R12: 0000000000000000 R13: ffffffff8fbc3f50 R14: ffff888039d832b8 R15: ffffffff8b6b8340 FS: 0000000000000000(0000) GS:ffff888125ce8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd6d27ed40 CR3: 00000000383fc000 CR4: 00000000003526f0 Call Trace: __debug_check_no_obj_freed lib/debugobjects.c:1171 [inline] debug_check_no_obj_freed+0x2e3/0x450 lib/debugobjects.c:1201 slab_free_hook mm/slub.c:2679 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x13e/0x6d0 mm/slub.c:6792 k90_cleanup_macro_functions drivers/hid/hid-corsair.c:547 [inline] corsair_remove+0xfd/0x260 drivers/hid/hid-corsair.c:602 hid_device_remove+0xc8/0x1d0 drivers/hid/hid-core.c:2897 device_remove drivers/base/dd.c:616 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372 bus_remove_device+0x449/0x560 drivers/base/bus.c:664 device_del+0x528/0x8f0 drivers/base/core.c:3965 hid_remove_device drivers/hid/hid-core.c:3126 [inline] hid_destroy_device+0x6b/0x1b0 drivers/hid/hid-core.c:3148 usbhid_disconnect+0x9f/0xc0 drivers/hid/usbhid/hid-core.c:1479 usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:618 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372 bus_remove_device+0x449/0x560 drivers/base/bus.c:664 device_del+0x528/0x8f0 drivers/base/core.c:3965 usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478 usb_disconnect+0x32d/0x990 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5415 [inline] hub_port_connect_change drivers/usb/core/hub.c:5715 [inline] port_event drivers/usb/core/hub.c:5879 [inline] hub_event+0x1bb7/0x4cf0 drivers/usb/core/hub.c:5961 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: f8 clc 1: 48 c1 e8 03 shr $0x3,%rax 5: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) 9: 74 08 je 0x13 b: 4c 89 ff mov %r15,%rdi e: e8 ad 0d 5b fd call 0xfd5b0dc0 13: 4d 8b 0f mov (%r15),%r9 16: 4c 89 ef mov %r13,%rdi 19: 48 8b 74 24 08 mov 0x8(%rsp),%rsi 1e: 48 89 ea mov %rbp,%rdx 21: 44 89 e1 mov %r12d,%ecx 24: 4d 89 f0 mov %r14,%r8 27: ff 34 24 push (%rsp) * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 48 83 c4 08 add $0x8,%rsp 33: ff 05 43 39 db 0a incl 0xadb3943(%rip) # 0xadb397c 39: 48 83 c4 10 add $0x10,%rsp 3d: 5b pop %rbx 3e: 41 5c pop %r12