Extracting prog: 5m15.339899677s
Minimizing prog: 47m41.002038026s
Simplifying prog options: 6m26.702927969s
Extracting C: 2m18.531756047s
Simplifying C: 0s


extracting reproducer from 38 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='- - -\n\x00', 0x6)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0)
write(r4, &(0x7f0000000200)='- - -\n\x00', 0x6)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0)
write(r5, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
single: failed to extract reproducer
bisect: bisecting 38 programs with base timeout 30s
testing program (duration=39s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 15, 4, 22, 18, 19, 19, 3, 14, 7, 17, 13, 14, 9, 13, 8, 2, 26, 15, 6, 27, 16, 14, 18, 25, 23, 13, 8, 17, 2, 14, 26, 17, 16, 15, 16, 21, 13]
detailed listing:
executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = socket(0x1d, 0x2, 0x6)
setsockopt$RDS_CANCEL_SENT_TO(r1, 0x6a, 0x1, 0x0, 0xc)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59)
connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}, 0xc4ca}, 0x1c)
socket$nl_generic(0x10, 0x3, 0x10)
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000380)={0x200, 0x4f, 0x4, 0x0, <r6=>0x0})
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9})
ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000180)={r6})
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/asound/timers\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0)
fcntl$lock(r0, 0x7, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x41, 0x0, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000400), 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, 0x0, 0xcc0443, 0x0)
madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe)
madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16)
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00')
preadv(r3, 0x0, 0x0, 0x5fae, 0x5)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
write(0xffffffffffffffff, &(0x7f0000000080)='4', 0x1)
executing program 2:
r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000100)={0x34, &(0x7f0000000140)={0xc0, 0xa1}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000340)={0x40, 0xa0}, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 2:
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008c}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = socket$igmp(0x2, 0x3, 0x2)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000007c0)={'macvlan1\x00'})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00'})
sendmsg$nl_route_sched(r3, 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000900)={'tunl0\x00', &(0x7f0000000880)={'ip_vti0\x00', 0x0, 0x700, 0x10, 0x8, 0x3, {{0xd, 0x4, 0x1, 0x14, 0x34, 0x68, 0x0, 0x8, 0x29, 0x0, @remote, @multicast1, {[@timestamp_prespec={0x44, 0x4, 0x88, 0x3, 0x8}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x8, 0x43, 0x0, 0x0, [0x6]}, @generic={0x7, 0xe, "abb73471590e5a4140817210"}, @end]}}}}})
r4 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000000))
setsockopt$MRT_DEL_MFC_PROXY(r2, 0x0, 0xd3, 0x0, 0x0)
openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
listen(r5, 0x1)
pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
executing program 2:
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
getsockname$packet(0xffffffffffffffff, 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6)
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x4)
writev(r3, &(0x7f0000000040), 0x0)
r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
bind$bt_sco(r4, 0x0, 0x0)
executing program 2:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
setrlimit(0x6, 0x0)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000280)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
socket$inet_sctp(0x2, 0x5, 0x84)
r4 = socket$inet_sctp(0x2, 0x5, 0x84)
r5 = socket(0x2, 0x805, 0x0)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x82, &(0x7f0000000540)={0x0, 0x2}, 0x8)
executing program 32:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
setrlimit(0x6, 0x0)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000280)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
socket$inet_sctp(0x2, 0x5, 0x84)
r4 = socket$inet_sctp(0x2, 0x5, 0x84)
r5 = socket(0x2, 0x805, 0x0)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x82, &(0x7f0000000540)={0x0, 0x2}, 0x8)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/infiniband\x00', 0x0, 0x0)
executing program 1:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
gettid()
timer_create(0x0, 0x0, 0x0)
sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002780)=ANY=[@ANYBLOB="640000000206010800000000000000000100000a16000300686173683a6e65742c706f72742c6e6574000000050001000700000005000500020000000900020073797a310000000005000400"], 0x64}, 0x1, 0x0, 0x0, 0x2006c0c4}, 0x0)
executing program 1:
syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0)
syz_usb_connect(0x0, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000401234567800010000000109021900010100e0010904000001ff00000007058101000401"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2)
ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x4004550c, &(0x7f0000000200))
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000400)=@urb_type_iso={0x0, {0x1, 0x1}, 0x0, 0x2, &(0x7f0000000500)='\x00'/1024, 0x400, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, [{0x400}]})
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
socket$inet_udp(0x2, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_tcp(0x2, 0x1, 0x0)
socket$kcm(0xa, 0x2, 0x73)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8)
mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x20, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x3, 0xd00}}}, &(0x7f0000000300)=<r0=>0x0)
r1 = dup(0xffffffffffffffff)
syz_ublk_setup_queues(r1, r0, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x0, 0x1000002, 0x1000091}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe344, 0x2, 0x40040001, 0x253}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x1000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0)
executing program 1:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840))
openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65)
openat$vicodec0(0xffffffffffffff9c, &(0x7f0000001340), 0x2, 0x0)
r1 = fsopen(&(0x7f00000000c0)='devtmpfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x1, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
setresuid(0xee01, 0xee00, 0x0)
fchdir(r2)
r3 = fanotify_init(0x200, 0x0)
fanotify_mark(r3, 0x1, 0x4800003e, 0xffffffffffffffff, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='- - -\n\x00', 0x6)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0)
write(r4, &(0x7f0000000200)='- - -\n\x00', 0x6)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0)
write(r5, &(0x7f0000000200)='- - -\n\x00', 0x6)
executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=ANY=[@ANYBLOB="500000000802110000010802110000000802110000000000000000000000000064001100000973797a6b616c6c6572010882848b960c1218240301242d1a6f0117ffff000000000000000000000000000000000000003d1624000000000000000000000000000000000000000000bf0c9159820faaff0000aaff0000c005012a000000ff16230800000000000000000000000000000000000000ff0724000000000000ff046c000000ff056a00000000ff096b0000080211000000ff0d98000400000000000000000002ff099728080000000002"], 0x93)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
syz_80211_inject_frame(&(0x7f0000000500)=@device_b, &(0x7f0000000540)=ANY=[@ANYBLOB="b00000000802110000010802110000000802110000001000000002000000"], 0x1e)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 0:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840))
openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65)
openat$vicodec0(0xffffffffffffff9c, &(0x7f0000001340), 0x2, 0x0)
r1 = fsopen(&(0x7f00000000c0)='devtmpfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
fsmount(r1, 0x1, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
setresuid(0xee01, 0xee00, 0x0)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x11)
r3 = fanotify_init(0x200, 0x0)
fanotify_mark(r3, 0x1, 0x4800003e, r2, 0x0)
executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000014c0)=@newtclass={0x44, 0x28, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x10, 0x2, [@TCA_HTB_CEIL64={0xc, 0x7, 0x6}]}}, @TCA_RATE={0x6, 0x5, {0xfe, 0x2}}]}, 0x44}}, 0x0)
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="5800000010003b0c00"/20, @ANYRES32=0x0, @ANYBLOB="0010000000000000380012800b00010065727370616e00"], 0x58}}, 0x0)
executing program 3:
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
close(r2)
listen(0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000200)={0x5, &(0x7f00000001c0)=[{0x4, 0x37, 0x89}, {0x4feb, 0x9, 0xf0, 0x1}, {0x7, 0x0, 0x9, 0x1ff}, {0x7f, 0x5, 0x0, 0x1}, {0x8, 0x3, 0x9}]}, 0x10)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r3 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7})
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x80200, 0x0)
io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='dummy_udc.0', 0xb)
executing program 5:
close(0xffffffffffffffff)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000280)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4004000)
r2 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = socket(0x2, 0x805, 0x0)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e23, @rand_addr=0x64010102}]}, &(0x7f00000007c0)=0x10)
executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000040)='bridge0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000140), &(0x7f0000000100)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/virtual/net/bridge0/bridge/no_linklocal_learn\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='1\n', 0x2)
executing program 3:
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = getpgrp(0x0)
unshare(0x22020600)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x8042, 0x20)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
add_key$fscrypt_v1(0x0, &(0x7f0000000080)={'fscrypt:', @desc2}, 0x0, 0x0, 0xffffffffffffffff)
openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x206643, 0x0)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f)
pipe(0x0)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1)
r6 = socket$unix(0x1, 0x1, 0x0)
mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040), 0x10c08, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}})
connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x300)
socket$can_j1939(0x1d, 0x2, 0x7)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x2, &(0x7f00000000c0)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, 0x0)
socket$inet6(0xa, 0x800000000000802, 0x0)
mkdir(&(0x7f0000000440)='./file0\x00', 0x88)
mount$cgroup(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100))
executing program 33:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='- - -\n\x00', 0x6)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0)
write(r4, &(0x7f0000000200)='- - -\n\x00', 0x6)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0)
write(r5, &(0x7f0000000200)='- - -\n\x00', 0x6)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f00000001c0)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='4\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r2, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='localhost / 2147483647 196606 0 0 0\n', 0x24)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)='localhost 1 \\x00000000 2147483647 /\n', 0x24)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000480), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,proto=tcp,vers=4.1,clientaddr=127.0.0.1'])
r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/testfile\x00', 0x42, 0x1b6)
write(r5, &(0x7f0000000700)='hello world\n', 0xc)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='1\n', 0x2)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='/dev/nullb1\n', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000600)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000740)='loop\n', 0x5)
executing program 5:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
r1 = socket(0x2, 0x80805, 0x0)
socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000400), 0x8)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c)
bind$inet6(r0, 0x0, 0x0)
sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008080}, 0x8000)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
connect$inet(r2, 0x0, 0x0)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0)
sendmmsg(r2, 0x0, 0x0, 0x810)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdirat(0xffffffffffffff9c, 0x0, 0x187)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44000880}, 0x4080)
bind$inet(r2, &(0x7f0000000240)={0x2, 0x4e24, @local}, 0x10)
mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='ufs\x00', 0x2208004, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='wusb3801 0', 0xa)
executing program 4:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840))
openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65)
openat$vicodec0(0xffffffffffffff9c, &(0x7f0000001340), 0x2, 0x0)
r1 = fsopen(&(0x7f00000000c0)='devtmpfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
fsmount(r1, 0x1, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
setresuid(0xee01, 0xee00, 0x0)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x11)
r3 = fanotify_init(0x200, 0x0)
fanotify_mark(r3, 0x1, 0x4800003e, r2, 0x0)
executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000014c0)=@newtclass={0x44, 0x28, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x10, 0x2, [@TCA_HTB_CEIL64={0xc, 0x7, 0x6}]}}, @TCA_RATE={0x6, 0x5, {0xfe, 0x2}}]}, 0x44}}, 0x0)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
socket$inet_udp(0x2, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_tcp(0x2, 0x1, 0x0)
socket$kcm(0xa, 0x2, 0x73)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8)
mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x20, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x3, 0xd00}}}, &(0x7f0000000300)=<r0=>0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
syz_ublk_setup_queues(r2, r0, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x0, 0x1000002, 0x1000091}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe344, 0x2, 0x40040001, 0x253}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x1000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="5800000010003b0c00"/20, @ANYRES32=0x0, @ANYBLOB="0010000000000000380012800b00010065727370616e00"], 0x58}}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/PNP0B00:00\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000100)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='oxu210hp-hcd\x00', 0xd)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/rtc_cmos\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f00000001c0)='unbind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='PNP0B00:00\x00', 0xb)
r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/drivers/oxu210hp-hcd\x00', 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000280)='bind\x00', 0x1, 0x0)
write(r5, &(0x7f00000002c0)='PNP0B00:00\x00', 0xb)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/serial8250\x00', 0x0, 0x0)
r7 = openat(r6, &(0x7f0000000340)='unbind\x00', 0x1, 0x0)
write(r7, &(0x7f0000000380)='serial8250\x00', 0xb)
executing program 5:
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
close(r2)
listen(0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000200)={0x5, &(0x7f00000001c0)=[{0x4, 0x37, 0x89}, {0x4feb, 0x9, 0xf0, 0x1}, {0x7, 0x0, 0x9, 0x1ff}, {0x7f, 0x5, 0x0, 0x1}, {0x8, 0x3, 0x9}]}, 0x10)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r3 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7})
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x80200, 0x0)
io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r4, &(0x7f0000000680)='dummy_udc.0', 0xb)
executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48)
r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r4, r5, 0x5}, 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r4}, &(0x7f00000000c0), &(0x7f0000000700)}, 0x20)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3)
executing program 5:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x2, &(0x7f00000000c0)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, 0x0)
socket$inet6(0xa, 0x800000000000802, 0x0)
mkdir(&(0x7f0000000440)='./file0\x00', 0x88)
mount$cgroup(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100))
executing program 4:
close(0xffffffffffffffff)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000280)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4004000)
r2 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
r3 = socket(0x2, 0x805, 0x0)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e23, @rand_addr=0x64010102}]}, &(0x7f00000007c0)=0x10)
executing program 0:
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee6, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2)
ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2})
ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2})
ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f00000001c0)=0x2)
executing program 5:
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008c}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = socket$igmp(0x2, 0x3, 0x2)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000007c0)={'macvlan1\x00'})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00'})
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000900)={'tunl0\x00', &(0x7f0000000880)={'ip_vti0\x00', 0x0, 0x700, 0x10, 0x8, 0x3, {{0xd, 0x4, 0x1, 0x14, 0x34, 0x68, 0x0, 0x8, 0x29, 0x0, @remote, @multicast1, {[@timestamp_prespec={0x44, 0x4, 0x88, 0x3, 0x8}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x8, 0x43, 0x0, 0x0, [0x6]}, @generic={0x7, 0xe, "abb73471590e5a4140817210"}, @end]}}}}})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x24, 0x0, 0x331, 0x1ffc, 0x40000000, {0x8}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x400400c}, 0x0)
setsockopt$MRT_DEL_MFC_PROXY(r2, 0x0, 0xd3, 0x0, 0x0)
openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0)
openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
listen(r4, 0x1)
pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0)
executing program 3:
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840))
openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0)
syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65)
openat$vicodec0(0xffffffffffffff9c, &(0x7f0000001340), 0x2, 0x0)
r1 = fsopen(&(0x7f00000000c0)='devtmpfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
fsmount(r1, 0x1, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
setresuid(0xee01, 0xee00, 0x0)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x11)
r3 = fanotify_init(0x200, 0x0)
fanotify_mark(r3, 0x1, 0x4800003e, r2, 0x0)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='- - -\n\x00', 0x6)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0)
write(r4, &(0x7f0000000200)='- - -\n\x00', 0x6)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0)
write(r5, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
single: successfully extracted reproducer
found reproducer with 14 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='- - -\n\x00', 0x6)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0)
write(r4, &(0x7f0000000200)='- - -\n\x00', 0x6)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/scsi_host/host5/scan\x00', 0x1, 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='- - -\n\x00', 0x6)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0)
write(r4, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='- - -\n\x00', 0x6)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/scsi_host/host4/scan\x00', 0x1, 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/scsi_host/host3/scan\x00', 0x1, 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/scsi_host/host2/scan\x00', 0x1, 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_host/host1/scan\x00', 0x1, 0x0)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
simplifying guilty program options
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program did not crash
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='- - -\n\x00', 0x6)

program crashed: WARNING: kobject bug in __scsi_remove_device
validation run: crashed=true
reproducing took 1h6m10.092450815s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kobject: '(null)' (ffff8880686de6f8): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 0 PID: 4432 at lib/kobject.c:728 kobject_put+0x8c/0x450 lib/kobject.c:726
Modules linked in:
CPU: 0 PID: 4432 Comm: syz.3.20 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:kobject_put+0x8c/0x450 lib/kobject.c:726
Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 46 0c b5 f7 48 8b 33 48 c7 c7 c0 c6 b1 8b 48 89 da e8 54 4e 2f f7 <0f> 0b eb 05 e8 6b c7 63 f7 4c 8d 73 38 4c 89 f7 be 04 00 00 00 e8
RSP: 0018:ffffc900034175e0 EFLAGS: 00010246
RAX: 9bdd1c739c881000 RBX: ffff8880686de6f8 RCX: ffff88807e2a9e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 0000000000000000 R08: ffffc90003417267 R09: 1ffff92000682e4c
R10: dffffc0000000000 R11: fffff52000682e4d R12: 1ffff1100d0dbce6
R13: dffffc0000000000 R14: ffff8880686de734 R15: 0000000000000200
FS:  0000555593726500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe5cb7535c0 CR3: 00000000243d8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __scsi_remove_device+0xc8/0x3b0 drivers/scsi/scsi_sysfs.c:1477
 scsi_alloc_sdev+0x91d/0xae0 drivers/scsi/scsi_scan.c:380
 scsi_probe_and_add_lun+0x1a0/0x44b0 drivers/scsi/scsi_scan.c:1183
 __scsi_scan_target+0x1d4/0x1050 drivers/scsi/scsi_scan.c:1715
 scsi_scan_channel drivers/scsi/scsi_scan.c:1803 [inline]
 scsi_scan_host_selected+0x374/0x6a0 drivers/scsi/scsi_scan.c:1832
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x49c/0x530 drivers/scsi/scsi_sysfs.c:191
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f26ba19e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc517b2a98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f26ba425fa0 RCX: 00007f26ba19e159
RDX: 0000000000000006 RSI: 0000200000000200 RDI: 0000000000000003
RBP: 00007f26ba23503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f26ba425fac R14: 00007f26ba425fa0 R15: 00007f26ba425fa0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kobject: '(null)' (ffff8880686de6f8): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 0 PID: 4432 at lib/kobject.c:728 kobject_put+0x8c/0x450 lib/kobject.c:726
Modules linked in:
CPU: 0 PID: 4432 Comm: syz.3.20 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:kobject_put+0x8c/0x450 lib/kobject.c:726
Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 46 0c b5 f7 48 8b 33 48 c7 c7 c0 c6 b1 8b 48 89 da e8 54 4e 2f f7 <0f> 0b eb 05 e8 6b c7 63 f7 4c 8d 73 38 4c 89 f7 be 04 00 00 00 e8
RSP: 0018:ffffc900034175e0 EFLAGS: 00010246
RAX: 9bdd1c739c881000 RBX: ffff8880686de6f8 RCX: ffff88807e2a9e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 0000000000000000 R08: ffffc90003417267 R09: 1ffff92000682e4c
R10: dffffc0000000000 R11: fffff52000682e4d R12: 1ffff1100d0dbce6
R13: dffffc0000000000 R14: ffff8880686de734 R15: 0000000000000200
FS:  0000555593726500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe5cb7535c0 CR3: 00000000243d8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __scsi_remove_device+0xc8/0x3b0 drivers/scsi/scsi_sysfs.c:1477
 scsi_alloc_sdev+0x91d/0xae0 drivers/scsi/scsi_scan.c:380
 scsi_probe_and_add_lun+0x1a0/0x44b0 drivers/scsi/scsi_scan.c:1183
 __scsi_scan_target+0x1d4/0x1050 drivers/scsi/scsi_scan.c:1715
 scsi_scan_channel drivers/scsi/scsi_scan.c:1803 [inline]
 scsi_scan_host_selected+0x374/0x6a0 drivers/scsi/scsi_scan.c:1832
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x49c/0x530 drivers/scsi/scsi_sysfs.c:191
 kernfs_fop_write_iter+0x3a0/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x482/0x9a0 fs/read_write.c:584
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f26ba19e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc517b2a98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f26ba425fa0 RCX: 00007f26ba19e159
RDX: 0000000000000006 RSI: 0000200000000200 RDI: 0000000000000003
RBP: 00007f26ba23503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f26ba425fac R14: 00007f26ba425fa0 R15: 00007f26ba425fa0
 </TASK>