Extracting prog: 44m25.60660345s
Minimizing prog: 20m49.174892689s
Simplifying prog options: 0s
Extracting C: 39.792369338s
Simplifying C: 12m24.161078183s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS_UPDATE-ioctl$XFS_IOC_FREE_EOFBLOCKS-syz_io_uring_complete-syz_open_procfs-preadv
detailed listing:
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 7, 7, 7, 6, 7, 20, 6, 7, 7, 7, 7, 7, 29, 7, 6, 7, 30, 7, 6, 7, 7, 7, 7, 7, 30, 7, 7, 6, 7]
detailed listing:
executing program 3:
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000100)={[0x8443, 0x1000009, 0xffffeffffffffffb, 0x8, 0x6, 0x7, 0x4002004c1, 0x5be3d206, 0xb, 0x4, 0x2, 0x0, 0x2, 0x2, 0xa, 0xffffffff7fffffff], 0x80a0000, 0x128106})
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000100)=""/21, 0x15}], 0x1)
ptrace$setregs(0xd, r0, 0x2, &(0x7f0000000180))
ptrace$cont(0x21, r0, 0x80000001, 0x4)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="8c00000009060101fffffff7000000000200ffff08000940000000390900020073797a3100000000050001000700fe005c0008801c00078018000180"], 0x8c}, 0x1, 0x0, 0x0, 0x10000082}, 0x4000080)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newtaction={0x8c, 0x1e, 0x109, 0x4000102, 0x25dfdbfc, {}, [{0x78, 0x1, [@m_mirred={0x74, 0x14, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x3, 0xa, 0xffffffffffffffff, 0x2, 0x6}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0x9, 0x5, 0x4, 0x8}, 0x3}}]}, {0x6, 0x6, "d10d"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x8c}, 0x1, 0x2b1e}, 0x2000c000)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
sendmsg$IPSET_CMD_GET_BYINDEX(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0xf, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x6}, [@IPSET_ATTR_INDEX={0x6, 0xb, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004001}, 0x4000000)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000082}, 0x4000080)
executing program 3:
socket$xdp(0x2c, 0x3, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000240)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f", 0x31}], 0x1)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', <r1=>0x0})
r2 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d00", @ANYRES16=r2, @ANYRES32=r2], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x2000800)
executing program 3:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r3, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140002"], 0x4c}}, 0x0)
executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000180)=0x4000000)
ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000080)=0x6100204)
r1 = epoll_create(0xa67)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x10000000})
pwritev(r0, &(0x7f0000000100)=[{&(0x7f0000000540)='\x00!', 0x2}], 0x1, 0x739, 0x1)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x24, 0x20, 0xf4db158ec847dc81, 0xfffffffc, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x15}, [@FRA_FLOW={0x8, 0xb, 0xf7}]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x44004)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e010203010902"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='\f\x00\x00\x00g\x00\"'], 0xc)
executing program 1:
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
r2 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0)
r3 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4)
connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x4e22, @remote}, 0xa)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r3, 0x0, 0x48c, &(0x7f00000002c0)={0x1, 'bridge0\x00', 0x1}, 0x18)
syz_usb_control_io$hid(r2, 0x0, 0x0)
r4 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r4, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e)
r5 = socket$unix(0x1, 0x3, 0x0)
bind$unix(r5, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e21}, 0x6e)
syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00')
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
executing program 4:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c4a616dc4010203010902120001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c)
r1 = fcntl$dupfd(r0, 0x0, r0)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000d40)={0x14, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x400c000}, 0x1)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1)
sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r2, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x20000090}, 0x41)
executing program 2:
mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2000, 0x103)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r1=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
io_setup(0x8, &(0x7f0000000280)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x6, r1, 0x0}])
executing program 0:
socket$inet_tcp(0x2, 0x1, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x10)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xd70, 0x1f280, 0x0, 0x1c7})
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00')
io_uring_enter(r0, 0x100, 0x11, 0x1f, 0x0, 0x0)
executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
writev(r0, &(0x7f0000000240)=[{&(0x7f0000000280)="0232e6fe", 0x4}], 0x1)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0)
ioctl$FS_IOC_READ_VERITY_METADATA(0xffffffffffffffff, 0xc0286687, 0x0)
r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r1)
ptrace$poke(0x5, r1, &(0x7f00000001c0), 0x7)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4)
connect$inet(r0, &(0x7f00000006c0)={0x2, 0x0, @dev}, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)={0x14, 0x10, 0x21, 0xfffffffd, 0x0, {0x3}}, 0x14}}, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000180)=0x2, 0x4)
sendmmsg$inet(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000005c0)="b8", 0x1}], 0x1}, 0xa6}], 0x1, 0x4008440)
executing program 2:
syz_open_dev$video4linux(&(0x7f0000000000), 0xb7c, 0x100)
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x9d49, 0x400, 0x2, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x240, 0x0)
ioctl$XFS_IOC_COMMIT_RANGE(0xffffffffffffffff, 0x40585883, &(0x7f00000001c0)={r4, 0x0, 0xfffffffffffff206, 0x3, 0x2a98, 0x2, [0x401, 0x6, 0x8, 0x0, 0x8, 0x1000]})
set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x3)
r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r5, 0x0, 0x0)
syz_usb_control_io$hid(r5, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff)
close(r7)
execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r10, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0xeeee8000, 0xf000, 0x7, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x1, 0xddccb000, 0xd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1}, {0x118004, 0xdddd8000, 0x18, 0xe, 0x0, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x6}, {0x10b002, 0x2000, 0xc, 0xfd, 0x80, 0x0, 0x1}, {0x1000, 0x0, 0xd, 0x8, 0x70, 0x80, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0x100026fff, 0xeeef0000, 0x8, 0x4, 0x0, 0x8, 0x0, 0x0, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0x10000, 0xf, 0x0, 0x5, 0x0, 0x0, 0x81, 0x0, 0x4}, {0xd000, 0x41000, 0x3, 0x82, 0xfc, 0x10, 0x4, 0xe}, {0x0, 0x800}, {0x1, 0xfffe}, 0x40000010, 0x0, 0x0, 0x10, 0x1000000000000001, 0x0, 0x900, [0x0, 0x0, 0x2, 0x5]})
ioctl$KVM_RUN(r10, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r10, 0x4140aecd, &(0x7f0000000100))
r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003c00), r6)
sendmsg$ETHTOOL_MSG_EEE_SET(r6, &(0x7f00000040c0)={0x0, 0x0, &(0x7f0000004080)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010026bd7000ffdbdf2518000000180001801400020067656e65766530000000000000000000d9de2b7491b4eeb7099957387d802f278da6f0073b8270e2dbd992e5d083c29c567d8a86ab37553ac0549039195ee96d7a7fcfb7c586260aba7a4d82fe0f1565dc125505ad1f06d7efe6eae2b510296d2f01ea0551713b016a537fa6674ffb188e9050ddd52316ccfed7ec064d47f89f63d0f36c135a2d29ac2265769683ddc249b58e9d28e90a2303da229941820c74413370379b99156f5d30535b21a1bd2265a3876b9281c0e68a1596a36c8be01b262ca53d7aeff5dd3e5f5fa5ca29c2aed958fba697ba6ae227ced4571e34a3fb6078ceb1ddb62a412c5e981aa9fcec4b8c2ae09ba2be4876d569ca4222d334e45c1a23c0b34bbcc8a349bd0000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x40008000)
r12 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r12, 0x81044804, 0x0)
set_mempolicy(0x4000, &(0x7f0000000080)=0xc00, 0xffffffffffffb176)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x21800, 0x0)
accept$alg(0xffffffffffffffff, 0x0, 0x0)
r13 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
executing program 0:
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e20, 0x1000, @local, 0x7ff}}, 0x9, 0x3, 0x9, 0x7fffffff, 0x8}, &(0x7f0000000280)=0x98)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x40000070, 0x0, 0x400006}]})
executing program 0:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0)
socket$kcm(0x10, 0x2, 0x0)
ioctl$DVB_DEMUX_DMX_GET_STC(0xffffffffffffffff, 0xc0106f32, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000040)=ANY=[@ANYBLOB="200f11000000", @ANYRES16=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0)
executing program 1:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff})
connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4)
socket$can_raw(0x1d, 0x3, 0x1)
sendmmsg$inet(r3, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c)
connect$inet6(r4, &(0x7f0000000000)={0x2, 0x4e23, 0x0, @mcast1, 0x4}, 0x1c)
r5 = socket$netlink(0x10, 0x3, 0x8000000004)
connect$inet6(r4, &(0x7f0000000800)={0xa, 0x4e24, 0xc0, @ipv4={'\x00', '\xff\xff', @loopback}, 0xc58e}, 0x1c)
writev(r5, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac710aa7d0000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1)
syz_open_dev$sg(0x0, 0x0, 0x40100)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x4)
preadv(r5, &(0x7f00000022c0)=[{&(0x7f00000006c0)=""/73, 0x49}, {&(0x7f0000000740)=""/155, 0x9b}, {&(0x7f0000000840)=""/239, 0xef}, {&(0x7f0000000940)=""/247, 0xf7}, {&(0x7f0000000a40)=""/166, 0xa6}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000001240)=""/4096, 0x1000}], 0x7, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'bridge_slave_1\x00', @link_local})
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={0xffffffffffffffff, 0x0, &(0x7f0000000640)=""/13, 0x2}, 0x20)
r7 = socket$netlink(0x10, 0x3, 0x0)
writev(r7, &(0x7f0000000e00)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}, {&(0x7f0000000c00)="f089544272076c4d41fd398602b89b3fa3a9c58c88fe7b2196418b996d0900ab2acfaec9736958e9251d2dc35428a4d9f2e99383bbd12a723adde1215cba8da2fdc128a0c03d99353c90f9872df89d9e17fe616960fa65b29a328c5a3ad12eef1b1c40dd6095277b3a3af49cb421ea7b54e04a5a4b3e69355c5990305623ead4c316857b5b0c02a2bc26238cb7570e5771d92572ae7a25d7ef3016422e47328807aa0d756af338ede7940af5c81003a1fd00a3f5", 0xb4}, {&(0x7f0000000d00)="8d2aadf53c167444d7ecf2ff4aebc7af0637ef9c57778a567de1ae283b63a457869d734c1a43768ad2ca13eebce8a40a3c3fc64f933b80aa681e48449e7cdb3dc8577006b9532ea431e2bc35239518388132f7b03ba7530aca3d55738e10823d67cfc4f779f3334bc2a00212772e14650115b553ec39d5a1d117343fed6e80a0bc8883e526252e9278d4d8a8bc56e59fd506dafe2b695add69459918b0acd7657b53a6bd1da27dd5244e2acbd72f315ffefc3212c7d5ee2ddeadef0c1027d554834014d0641099407b62ed00fe72eacde224fce85be583b7c35e2747763b8f5926", 0xe1}], 0x3)
sendto$inet(r3, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
madvise(&(0x7f00000ee000/0x2000)=nil, 0x2000, 0x8)
readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/13, 0xd}, {&(0x7f0000000180)=""/15, 0x13}], 0x1d)
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0xb81, 0x0)
close(r0)
close(0xffffffffffffffff)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x3, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x4}]}], {0x14}}, 0x90}}, 0x40000)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6)
ioctl$TUNGETVNETLE(r0, 0x40107447, &(0x7f0000000180))
executing program 4:
openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/timer_list\x00', 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
ptrace$poke(0x5, r0, &(0x7f0000000040), 0x6)
executing program 4:
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r0 = socket(0x840000000002, 0x3, 0xff)
sendmsg$inet(r0, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000040)="9744012000000000035bdb61ea02df7bc728d08701008cc5595c08ff", 0x1c}], 0x1, &(0x7f00000008c0)}, 0xc884)
r1 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80081}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0x0, 0x9}, {0xfff3, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IP_TOS={0x5, 0x50, 0x5e}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0)
executing program 4:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="020000000400000004"], 0x50)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x64)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325})
bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x5, @remote, 0x6e}, 0x1c)
io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8101, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0xfffffffe, 0x0, "0062ba7d82000000000000000000f7fffeff00"})
r1 = syz_open_pts(r0, 0x8182)
dup3(r1, r0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x9a1, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5c, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x20005, 0x7, 0x5, 0x8006, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x3ff, 0x5, 0x3e, 0x18a, 0x5, 0x6, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0xa, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0xf, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x16, 0x400, 0x9, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x9, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x1, 0x6, 0x101, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x13, 0x3, 0x4000009, 0x6, 0x4000000, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x80004, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x8002, 0x0, 0x9, 0xb, 0x4, 0x45, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x2000000b, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0x9e, 0x4, 0xa9, 0x5, 0x0, 0xac8, 0xbf, 0x2, 0x80, 0x7ff, 0x12b, 0x1, 0xc921, 0xa, 0xffffffff, 0x5, 0x2, 0x1, 0x807ff, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x1938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x6, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x25, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0xf1, 0x803, 0xd7, 0x7fff, 0xfffffffa, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)
executing program 2:
bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0)
r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
timer_create(0x7, &(0x7f0000000240)={0x0, 0x21, 0x2}, 0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x8})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0)
r2 = fsmount(r1, 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f0000003240)=[{&(0x7f0000000340)="47dad0e3466af430e94c4c6e8e2a5400bbc61fd54e31bc1836c40e7ea2601c5ddaf3ca645b13d2ed95e2e9e35b5c4920fb52ce60a7811c8a58a43c9abc2a44a197bb95ae8b156658daaff8ee34fc548b64ab36fe520906ffc1bd6d5cd0b6c368d3149a18ec658cd5cd210eae8ac8a97f2be2fbb013425a120995a4aa59bbb862e11cb5a1ed7322588d898e3caa68", 0x8e}, {&(0x7f0000002080)}, {&(0x7f0000003080)="9fee4fd30f8f427ae890ad1980fd6bb080b35b8558fd019b8a2342b840ec93aac7dccab9281228", 0x27}, {&(0x7f00000030c0)="f6bdeeffdb82ddc8044dd83729937d82762cad39657e4b0cea770db3f63c437e01d900b30f3a437e8d3acd1078376c678ef2ab291b7c43c650d5647955f526c956f6f90cce1d3132090832728d832bd3d045925305e4a08d62ead5277ade01ecea3b014e04c458679f5831964f964ace0a2ce3a3dc43af25b74556b0a0ad343b91000ab1a94f838352c72db843f23843754c2c448eb5144572b30ab7d27987e9531147", 0xa3}, {0x0}, {&(0x7f00000031c0)}, {&(0x7f0000003200)="b6352b1c", 0x4}], 0x7)
fchdir(r2)
r3 = open(0x0, 0x8000, 0x112)
getdents(r3, 0x0, 0x0)
getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000040)=0x80000001, 0x4)
setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f00000001c0)='wg2\x00', 0x4)
listen(r4, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, r2, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x400)
r5 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x80002)
ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2})
ioctl$VIDIOC_QBUF(r5, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000})
syz_usb_connect(0x4, 0x36, &(0x7f00000032c0)=ANY=[@ANYBLOB="6ffdc8ab76180721be0e4e9a27ad806f8c8199f6fc1525b96b1aaa426856701aabc99fb7e2e15ab641d12f63226ff7b61222ac59e7fc4c22120681487c24079213dc1f89b7d02c03cf07851956aeeb6ee25bc4758331971cee5d2e73f15952400255b3c158b4954130f921fca01d2c4ad65113fb06543b7e50b002b6c10452682953702dd67f50951b1f70374ab2aab233989234572a8e2af3c43e4f3b00cb41c9c83db1afc89335beda9686c924f004879f51d4b51f8c7cf041390cb808eb87d4d738c5f8c0f7130d50722f8a7beb16921fdb744587c6b5410be15ed7c089aaa42879bed2994e36b07c8b5534d7c0e9188dce03c08743109b765aaf402296d60f305c208e54e2b97f25ef2ad153d61879627b2a1bfec94d3f4976aad155dd7fab5dbdf7ade28f2caf4ab01c7d45da20ee9ce878607122aa88d0a08ffba63254073f98b5a112ec91641c47cc2312927e946ced6c152b2901377dbdae018231fa736a9613573edf8306a885654505875c07351ef69ec837a41b84e1299d09ebe1012486d3665e21d88b20412fa2403ad5361fa73c3b447fd1a5a578ba4e20709109e435f0ec8b4d04e8dc07c1db9874e070fe54240432689f383f666cb36c193aaa2bc3f849ae71976a3b3a4157631886e26188bd42a2283c35eaa5b492331ac654b868cc83f52a2cc98b661e6150a4443e7888adae6f708d9864c887f341c08e4cce055acb4a182591ff1364c4e72da5440c483cc4f2804f938e01eccdde89f3643153e6b10ea0b7c94415ada75cf8f927305930724eb4237458ebe76ba11691283b2b0eee6b2693dd167a04d532353249b2093f2cc65ad98eb18b9b34df3b017c5c1763841d4de80f8618e45b82f2be7b0d6192287df84b9db1ebedbcb51f3225a7ed00d8f97f79754be7049894bffe03ad7d6dd0b38033de0d69bd53a9d34db155a85e0d68484ed82bbfcf69398e53edce5ab82184a83b621750f91a2dd9763524bfadd9997399985a3c068ae0b6f08bbe26c94d842dc2486cf1fb45aacb41d9538e5e3c9238435ca622f0663de54d5fe7edbff7121f1ef107daa21e2c926d0c7b2a387542a52e672eeb91abe345472d9da3bb7a58c70866ca0ccb6db06f017c7cd141fdbb068e9f06bd8b67b8f51b1240a6986e77c3e1c3aaa2ec6d31079d21a1ef2cc9c084649fffae20be2b8a2f1ef73eec96327bc10a38c6ba276b094563a6d298940e80daff7edc5dee0bf7b564f78733624e6b8d318630ea3a39019d1b39040e75b8a9a8954ecd693296d60dcf0e1f4e72faa3074915dae3abcbe9c73d9b621f80bc44e55025d98ccfe52867ba9fc2be8a366980cc96d9c1529a3401be83e2b1f60007aee4e77d95fea289e0ac541a5e76113d8f1d7983d90f75c1b81512918d276e5db9e2899b943b80800160808fcaa3bb64dde9d5607010d7ceef3294d7da4a441608faf9c8b53b920c026c61a02e6adde1dd6ecd9a9ffdc51ef073f096ec6aecf03144a00b642f85365263043a13e325f83c7845bb50be817f49d47b0c2a8e98a48d6c29c8043d11754515aa4e9d9b3a4d1dc96887a1617ebad6fd23520a37ae570cc11d9c8ba254104e51abe2968a155e1368016aa93b78fe5ce7b8dd3941020535d24633d847323229ce756a775d2adb1e008135390a4927fe49fb1d0eb9988e811ec31aaf15e0fd327947db8fe6da96d397dcc10e6c0be7a4c4d10346dcd81e7806e47a35434459af0e1f160b2fef4ba560cfd4394b1ed4af889955f257f58ab3da047d1c6dcf74c46693806141a8a23bc64c47ee3d0ece325709df9c33eb093d08a9a4c9aa9f2abcbe8c4cf95ef27f781f4af2e3e3140842272b0e79c8de767938aad4257fb4b6a9ae99b9e37197ae389d359b500ffac60fa5f26376a61b6854e29b35228da4cfde31c23a033caeb7959447cce730cf7f82c040e2c3e04168b54cb4fa3285a7c6e774a1dfcd63feb7bed6cee90a3b12568cca23ecdf5191a3fd1a268dd2623194119c8d514cb105e4c8df7533a10a4ecf53cabda13437e28f7b1daea2f465957845f688e7b341355a98b9e57e411a1e2660d84ce06f9d66b596517439af1a63c14c9b4b04659548654fff37cfb46e44e274e9132e8cc3d897e1f42e3906cf212ca3bda8e8c7edfbfdd3c9b5e729e75797b260c9b2001e868ef261a0d916d4657688d119c86ad39c6cd5d3e26af764dea1e83fa03e43fa66a1635f9ce0f1856cf5b496428a848a066e93f3bb84e39a416dcbbb4027e151ce5091c239c9d7d18ffc279035bc06310af95129420b46f95c930272089c854753b6b18e5dfd07793dd2ebe3616e4da1c11fd782e754f7f8a39839d70a8e49b9532ffb5fe23318907265b9910536d0054acd1b43d5764c54e17a698ca9b7dfe4559251f2a87970b37f93e5fe185a3c6e85ff59e3a55004731f6b756949931e6198411cb5567021962a6c770cbbe26b84fb791e97bc1d752818c0a804788446689b7d3896320f16e7a16db0e9538b8bb79ef797632a68434ff720759edab6a2607b7d1c97e364fd09e48a11f93c5898dbb45925ce22af4522bc093a59d560a542f11572ba4d18ad3bbd8db00856ac6d32460c023334d62b0f5a1c7e4eeb35e27a14b9489871d7f1b30f06d35e3ca26889f30a17dd092807e69fc1543170d1eff23b4802face0cb5e52418518fbf01fb77c7ccd5fb8141e01c827ff916f2da362c173b5782570cd3acae4d47d391eeffe1678bcd31fa33421357810aabf47bddec6d9eafb779f704f024bfac2bc7adf38d9beb2798be8fa94032025425e1dc3b7ed73a4b0eddd7d5ab3a06e0174916f61c185718ea9f60ac33edb7379af99b34fc28f99444258e80a6bd2a5c3555c4354c4c635cadc9d41964b7f4386d8a87c26d461a1446051ecdd8c83c17fd858df8d7bb14360216257f1c2f45635dd9acf5fe904aab9908d2c9a8e309a4865e3af5eda84114a9890287f11d3176c337e26f46c92700306c3aa54c3bfdd92637b322de78e883fd809abe494ac1669c103cc0ee18e66bb8b61ffd6c5c28936ef9daa58c5e101be464c57094860d58f2cd02fc61192b2b72dc72c74d1237163ca177653d9aab2f12063aa71419790988fb723fce32f84d06fad204d1107e124068faace8e5bfc7f2c2bff160842632b4c74cf546434d7a8596c609e7131de6b5942e7dfd9daebd3362d5cf794473deeba593cf494c13b6fa1eb7f11e98a6483cd1c9a17ec9433d69bb71e2612126b706ec35a98bdf9e560527398799f89df351c8c7f5476d9ffdb9960991ec443da66090a4ee9019d7c98c7237bcaa89a7511e404431f178aee267b77dfbe2688b0d1d0aa5a3916ae1d747b9a0e9285fcd1bca4fc2990e3d618a2a98b08a9c6db19cb4dcd9139e5b958067627da4a3d35bbba3f4a91775483db58e67fb42b976978168ce9e1d97a2d0cb69fc12002e213615ae9e3b35426d1b5e60480781216a9086027183f27af6e344a1eaf8eeb61bedd7452a64fc33d84ad5562e02b8a49364b0831258ece730e7ba96fe78a51678d5b5f2b6c3c3bc121949fbc777e28c670d34d890cb5a9538f530143f36827ec68b476fd9a57436d41944b12d60cb48a0a3523cb8afb60e1d78fbb661bf620621cd517eb3dfc2457606371595d17aba9b4dc3d42d0345cc81b9aedb916cb4cbf32555f07686c007e831c269ed1e6aa961c0424bba744159eb0cf307f53724b80cc5c063e240f1f0f4c78ea01bd204a01d973ba5511130e02952a88f48668852d984ae2142d4b0ceb39197968ce199d4e936b9954feaa8a8bff3d7bd6031a425c31a1de0a3c48cc6d8b679546b83031e5f98fa4c900e82fe696d4bcb9aee54bd1f44b6bdb694616a627ae0c43ba9413877818ae881eb53141944028c762b6e15cc26d2aa5db7e44af84bcc1f5b6f0c2c23d0c883f4b224dce73e8c256d8ec4f4c47d49d550f508f4416808374fe64b9cf7cf1443e21973a72f221f3f833232dbc7b2e3bb3764979bcee46bbe76531fe62d548219caa9260692f08ccddb9eb88ed782035702aa00e37b3fec10b161e5f93fd110fa8345cf0c1b9e2ce021de3d0350aafd14155bf30a9d2876ae78d89945dec3cbad988cccd08e4bccb6daa36cfd3d10e9036c47599d80260c3f98da52cd9080e43fc53165c9a67c1d0ace498b227c3b55f9da80dc2057a15a8f3b5b130db1d13828864655f7a7b0fe33f554ac63ec7a63490f2a1dc060f498e47b258bc16ebbf89396ca33bc00e3e14342e04d149432257e9299609b52ced26988b8e5e4ac4e8ea1487b4e871bc3b4c9315c9d2e63397e66be29f592f8469ed52defb02f844a80ba58426fffd78509f22f3d9c6689cf143ea7df4d4cf105784e413cd6c5407735f513234cc883897b6a371c6998bce24638dc8e663920dcec5344bd2b1f9b0c5b93225d4039d9ac532b4633dfab858741ea9ff77ca426604f5940ec27dda7a2e7b5c3cb6a108298dfd86edadfba1230427f8d5bd142d7c5606287555d084a00e41606b214da562e029eab4da646f2e6705ac686384dfb68e60b2938f2ede3be86106e1bd9c82d4aa950c75f1320d372341a6878364abe35511a05f9f5c9fb2720b45b400a46130884e14a047865461ddd3a684798e64d977a6d24dbb5364a4dc774693a411f8f2a8c339a2cdea8ffc92f3166d541273d9518204d357afdc75e860f7541285f00441139c481adcf733b07364ebaadd279b84a459c707614e813b8962afbf46791f391ef79b051a2eb132193adf86e441350a8d6da44488c6984663aeb016b4e77ad0159e109b2ef9de5e1ab892a5281a1e1e3a21291d0d77b99ca2304139facc645a0d38b73c8ee908a5d1e1a5b6739f5ee56562b8ec10d0e944a0c28b362643363923b003fe3358a4e58e7c107968f19423eb3009047e61803e0f4a0969353ec274907e9663c4398e1d29b6b612576f0a4f9222960a4f2e49f1fcda63548c5968bec2cbd72f733d9e42a8dfcb4dd8b6d20471dbb9dd109e52a5da36bce113f636ba148b7b0fe3172a046a2f4465b99c1eab9c78eae3a8f7a37f1b577bccce8d83cc80d74f99866782aa7963a9301885398288c5e4f431c8b6bce9e008176adb65afc8c26e9850a470d924a308a974735645d19a85f95fef07ab46a0ffb7f8908c81ada337772abc6e8eb2564e093639416822e49923837391d9f3aedf92a2a06abd313dfaef75aa690d87203516090b13f93e10f61380866c68071426723ebc270588d7294267df054cd269b8fec82411fb6d7f92b5e7f41e5e27a4401406f3c6d6e85e7e03ccc6d59ee80eb1d3bb9b43b818af31143e3e57f979667d671a80ed07c67fd081ab722261fad297878208bf6ed73821b7a4234befa3140108f34b970bef36b62e4c4ef56852329a41c0ca84977ca81aa9ee2eff8b0b4bdce0e89e36b3a8026a2ce0d02ae525a2dae068b1e2a56cd076ac3938d98df03d645d91491d8797390d7b4893a68a637e59967c44430c82068db20cf580f81fc8472aa2671c297f846860895c71fab1b3f5023bd1e21e8670fad753a094cf761668c3f93a7a64f46b0f662ab724154eef49bcca3e250f0708355c2df6e5e26026ef7b8f183432e0d926104241b875a2d69b1ab373b6b4732d1ba218f02568fb92806dd642f427998e0ab1afb6422906ba59782e250200f8017b8b7b766387df2948bc901ff540f0cfdbcffd46e439eb1f1ce0f67966426a7f5be15294c6c3348618bddab841e32eeb2665004908ca5bb38d6a0a977f824bf83b248fcc8d04a", @ANYRESHEX=r0], 0x0)
ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2})
r6 = add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)='[', 0xfeed, 0xffffffffffffffff)
keyctl$revoke(0x3, r6)
ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f00000001c0)=0x2)
ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f0000000200)=0x1)
executing program 4:
syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650caa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94)
r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x2, 0x4, 0x200, 0x0, {0x77359400}, {0x1, 0x2, 0x0, 0x0, 0x0, 0xfe, "05000100"}, 0x0, 0x2, {}, 0x20800})
write$binfmt_misc(r1, &(0x7f0000000040), 0xe09)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x80000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x31]}})
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="120000000100000004"], 0x50)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000240), 0x3)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "7c98b307afa2738e", "9797fed914ba965b281cbe8c9b39e729", "049cee36", "90993a510db0b184"}, 0x28)
writev(r0, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x100000000000027b)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff3, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0xe38, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x40010)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_io_uring_setup-io_uring_register$IORING_REGISTER_BUFFERS_UPDATE-ioctl$XFS_IOC_FREE_EOFBLOCKS-syz_io_uring_complete-syz_open_procfs-preadv
detailed listing:
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 1m40s
testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 7, 7, 7, 6, 7, 20, 6, 7, 7, 7, 7, 7, 29, 7, 6, 7, 30, 7, 6, 7, 7, 7, 7, 7, 30, 7, 7, 6, 7]
detailed listing:
executing program 3:
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000100)={[0x8443, 0x1000009, 0xffffeffffffffffb, 0x8, 0x6, 0x7, 0x4002004c1, 0x5be3d206, 0xb, 0x4, 0x2, 0x0, 0x2, 0x2, 0xa, 0xffffffff7fffffff], 0x80a0000, 0x128106})
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000100)=""/21, 0x15}], 0x1)
ptrace$setregs(0xd, r0, 0x2, &(0x7f0000000180))
ptrace$cont(0x21, r0, 0x80000001, 0x4)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="8c00000009060101fffffff7000000000200ffff08000940000000390900020073797a3100000000050001000700fe005c0008801c00078018000180"], 0x8c}, 0x1, 0x0, 0x0, 0x10000082}, 0x4000080)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newtaction={0x8c, 0x1e, 0x109, 0x4000102, 0x25dfdbfc, {}, [{0x78, 0x1, [@m_mirred={0x74, 0x14, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x3, 0xa, 0xffffffffffffffff, 0x2, 0x6}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0x9, 0x5, 0x4, 0x8}, 0x3}}]}, {0x6, 0x6, "d10d"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x8c}, 0x1, 0x2b1e}, 0x2000c000)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
sendmsg$IPSET_CMD_GET_BYINDEX(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0xf, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x6}, [@IPSET_ATTR_INDEX={0x6, 0xb, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004001}, 0x4000000)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000082}, 0x4000080)
executing program 3:
socket$xdp(0x2c, 0x3, 0x0)
socket$xdp(0x2c, 0x3, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000240)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f", 0x31}], 0x1)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', <r1=>0x0})
r2 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d00", @ANYRES16=r2, @ANYRES32=r2], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x2000800)
executing program 3:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r3, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140002"], 0x4c}}, 0x0)
executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000180)=0x4000000)
ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000080)=0x6100204)
r1 = epoll_create(0xa67)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x10000000})
pwritev(r0, &(0x7f0000000100)=[{&(0x7f0000000540)='\x00!', 0x2}], 0x1, 0x739, 0x1)
executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x24, 0x20, 0xf4db158ec847dc81, 0xfffffffc, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x15}, [@FRA_FLOW={0x8, 0xb, 0xf7}]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x44004)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e010203010902"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
write$UHID_INPUT2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='\f\x00\x00\x00g\x00\"'], 0xc)
executing program 1:
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x0)
syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
r2 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0)
r3 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4)
connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10)
connect$inet(r3, &(0x7f0000000200)={0x2, 0x4e22, @remote}, 0xa)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r3, 0x0, 0x48c, &(0x7f00000002c0)={0x1, 'bridge0\x00', 0x1}, 0x18)
syz_usb_control_io$hid(r2, 0x0, 0x0)
r4 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r4, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e)
r5 = socket$unix(0x1, 0x3, 0x0)
bind$unix(r5, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e21}, 0x6e)
syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00')
getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
executing program 4:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c4a616dc4010203010902120001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c)
r1 = fcntl$dupfd(r0, 0x0, r0)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000d40)={0x14, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x400c000}, 0x1)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1)
sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r2, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x20000090}, 0x41)
executing program 2:
mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2000, 0x103)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}})
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r1=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
io_setup(0x8, &(0x7f0000000280)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x6, r1, 0x0}])
executing program 0:
socket$inet_tcp(0x2, 0x1, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x10)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xd70, 0x1f280, 0x0, 0x1c7})
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00')
io_uring_enter(r0, 0x100, 0x11, 0x1f, 0x0, 0x0)
executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
writev(r0, &(0x7f0000000240)=[{&(0x7f0000000280)="0232e6fe", 0x4}], 0x1)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0)
ioctl$FS_IOC_READ_VERITY_METADATA(0xffffffffffffffff, 0xc0286687, 0x0)
r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r1)
ptrace$poke(0x5, r1, &(0x7f00000001c0), 0x7)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4)
connect$inet(r0, &(0x7f00000006c0)={0x2, 0x0, @dev}, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)={0x14, 0x10, 0x21, 0xfffffffd, 0x0, {0x3}}, 0x14}}, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000180)=0x2, 0x4)
sendmmsg$inet(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000005c0)="b8", 0x1}], 0x1}, 0xa6}], 0x1, 0x4008440)
executing program 2:
syz_open_dev$video4linux(&(0x7f0000000000), 0xb7c, 0x100)
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x9d49, 0x400, 0x2, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x240, 0x0)
ioctl$XFS_IOC_COMMIT_RANGE(0xffffffffffffffff, 0x40585883, &(0x7f00000001c0)={r4, 0x0, 0xfffffffffffff206, 0x3, 0x2a98, 0x2, [0x401, 0x6, 0x8, 0x0, 0x8, 0x1000]})
set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x3)
r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r5, 0x0, 0x0)
syz_usb_control_io$hid(r5, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff)
close(r7)
execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r10, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0xeeee8000, 0xf000, 0x7, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x1, 0xddccb000, 0xd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1}, {0x118004, 0xdddd8000, 0x18, 0xe, 0x0, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x6}, {0x10b002, 0x2000, 0xc, 0xfd, 0x80, 0x0, 0x1}, {0x1000, 0x0, 0xd, 0x8, 0x70, 0x80, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0x100026fff, 0xeeef0000, 0x8, 0x4, 0x0, 0x8, 0x0, 0x0, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0x10000, 0xf, 0x0, 0x5, 0x0, 0x0, 0x81, 0x0, 0x4}, {0xd000, 0x41000, 0x3, 0x82, 0xfc, 0x10, 0x4, 0xe}, {0x0, 0x800}, {0x1, 0xfffe}, 0x40000010, 0x0, 0x0, 0x10, 0x1000000000000001, 0x0, 0x900, [0x0, 0x0, 0x2, 0x5]})
ioctl$KVM_RUN(r10, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r10, 0x4140aecd, &(0x7f0000000100))
r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003c00), r6)
sendmsg$ETHTOOL_MSG_EEE_SET(r6, &(0x7f00000040c0)={0x0, 0x0, &(0x7f0000004080)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010026bd7000ffdbdf2518000000180001801400020067656e65766530000000000000000000d9de2b7491b4eeb7099957387d802f278da6f0073b8270e2dbd992e5d083c29c567d8a86ab37553ac0549039195ee96d7a7fcfb7c586260aba7a4d82fe0f1565dc125505ad1f06d7efe6eae2b510296d2f01ea0551713b016a537fa6674ffb188e9050ddd52316ccfed7ec064d47f89f63d0f36c135a2d29ac2265769683ddc249b58e9d28e90a2303da229941820c74413370379b99156f5d30535b21a1bd2265a3876b9281c0e68a1596a36c8be01b262ca53d7aeff5dd3e5f5fa5ca29c2aed958fba697ba6ae227ced4571e34a3fb6078ceb1ddb62a412c5e981aa9fcec4b8c2ae09ba2be4876d569ca4222d334e45c1a23c0b34bbcc8a349bd0000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x40008000)
r12 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r12, 0x81044804, 0x0)
set_mempolicy(0x4000, &(0x7f0000000080)=0xc00, 0xffffffffffffb176)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x21800, 0x0)
accept$alg(0xffffffffffffffff, 0x0, 0x0)
r13 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
executing program 0:
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e20, 0x1000, @local, 0x7ff}}, 0x9, 0x3, 0x9, 0x7fffffff, 0x8}, &(0x7f0000000280)=0x98)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x40000070, 0x0, 0x400006}]})
executing program 0:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0)
socket$kcm(0x10, 0x2, 0x0)
ioctl$DVB_DEMUX_DMX_GET_STC(0xffffffffffffffff, 0xc0106f32, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000040)=ANY=[@ANYBLOB="200f11000000", @ANYRES16=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0)
executing program 1:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff})
connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4)
socket$can_raw(0x1d, 0x3, 0x1)
sendmmsg$inet(r3, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c)
connect$inet6(r4, &(0x7f0000000000)={0x2, 0x4e23, 0x0, @mcast1, 0x4}, 0x1c)
r5 = socket$netlink(0x10, 0x3, 0x8000000004)
connect$inet6(r4, &(0x7f0000000800)={0xa, 0x4e24, 0xc0, @ipv4={'\x00', '\xff\xff', @loopback}, 0xc58e}, 0x1c)
writev(r5, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac710aa7d0000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1)
syz_open_dev$sg(0x0, 0x0, 0x40100)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x4)
preadv(r5, &(0x7f00000022c0)=[{&(0x7f00000006c0)=""/73, 0x49}, {&(0x7f0000000740)=""/155, 0x9b}, {&(0x7f0000000840)=""/239, 0xef}, {&(0x7f0000000940)=""/247, 0xf7}, {&(0x7f0000000a40)=""/166, 0xa6}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000001240)=""/4096, 0x1000}], 0x7, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'bridge_slave_1\x00', @link_local})
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={0xffffffffffffffff, 0x0, &(0x7f0000000640)=""/13, 0x2}, 0x20)
r7 = socket$netlink(0x10, 0x3, 0x0)
writev(r7, &(0x7f0000000e00)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}, {&(0x7f0000000c00)="f089544272076c4d41fd398602b89b3fa3a9c58c88fe7b2196418b996d0900ab2acfaec9736958e9251d2dc35428a4d9f2e99383bbd12a723adde1215cba8da2fdc128a0c03d99353c90f9872df89d9e17fe616960fa65b29a328c5a3ad12eef1b1c40dd6095277b3a3af49cb421ea7b54e04a5a4b3e69355c5990305623ead4c316857b5b0c02a2bc26238cb7570e5771d92572ae7a25d7ef3016422e47328807aa0d756af338ede7940af5c81003a1fd00a3f5", 0xb4}, {&(0x7f0000000d00)="8d2aadf53c167444d7ecf2ff4aebc7af0637ef9c57778a567de1ae283b63a457869d734c1a43768ad2ca13eebce8a40a3c3fc64f933b80aa681e48449e7cdb3dc8577006b9532ea431e2bc35239518388132f7b03ba7530aca3d55738e10823d67cfc4f779f3334bc2a00212772e14650115b553ec39d5a1d117343fed6e80a0bc8883e526252e9278d4d8a8bc56e59fd506dafe2b695add69459918b0acd7657b53a6bd1da27dd5244e2acbd72f315ffefc3212c7d5ee2ddeadef0c1027d554834014d0641099407b62ed00fe72eacde224fce85be583b7c35e2747763b8f5926", 0xe1}], 0x3)
sendto$inet(r3, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
madvise(&(0x7f00000ee000/0x2000)=nil, 0x2000, 0x8)
readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/13, 0xd}, {&(0x7f0000000180)=""/15, 0x13}], 0x1d)
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0xb81, 0x0)
close(r0)
close(0xffffffffffffffff)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x3, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x4}]}], {0x14}}, 0x90}}, 0x40000)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6)
ioctl$TUNGETVNETLE(r0, 0x40107447, &(0x7f0000000180))
executing program 4:
openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/timer_list\x00', 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
ptrace$poke(0x5, r0, &(0x7f0000000040), 0x6)
executing program 4:
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r0 = socket(0x840000000002, 0x3, 0xff)
sendmsg$inet(r0, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000040)="9744012000000000035bdb61ea02df7bc728d08701008cc5595c08ff", 0x1c}], 0x1, &(0x7f00000008c0)}, 0xc884)
r1 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80081}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0x0, 0x9}, {0xfff3, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IP_TOS={0x5, 0x50, 0x5e}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0)
executing program 4:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="020000000400000004"], 0x50)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x64)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325})
bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x5, @remote, 0x6e}, 0x1c)
io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8101, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0xfffffffe, 0x0, "0062ba7d82000000000000000000f7fffeff00"})
r1 = syz_open_pts(r0, 0x8182)
dup3(r1, r0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x9a1, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5c, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x20005, 0x7, 0x5, 0x8006, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x3ff, 0x5, 0x3e, 0x18a, 0x5, 0x6, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0xa, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0xf, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x16, 0x400, 0x9, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x9, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x1, 0x6, 0x101, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x13, 0x3, 0x4000009, 0x6, 0x4000000, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x80004, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x8002, 0x0, 0x9, 0xb, 0x4, 0x45, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x2000000b, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0x9e, 0x4, 0xa9, 0x5, 0x0, 0xac8, 0xbf, 0x2, 0x80, 0x7ff, 0x12b, 0x1, 0xc921, 0xa, 0xffffffff, 0x5, 0x2, 0x1, 0x807ff, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x1938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x6, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x25, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0xf1, 0x803, 0xd7, 0x7fff, 0xfffffffa, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)
executing program 2:
bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0)
r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
timer_create(0x7, &(0x7f0000000240)={0x0, 0x21, 0x2}, 0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x8})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0)
r2 = fsmount(r1, 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f0000003240)=[{&(0x7f0000000340)="47dad0e3466af430e94c4c6e8e2a5400bbc61fd54e31bc1836c40e7ea2601c5ddaf3ca645b13d2ed95e2e9e35b5c4920fb52ce60a7811c8a58a43c9abc2a44a197bb95ae8b156658daaff8ee34fc548b64ab36fe520906ffc1bd6d5cd0b6c368d3149a18ec658cd5cd210eae8ac8a97f2be2fbb013425a120995a4aa59bbb862e11cb5a1ed7322588d898e3caa68", 0x8e}, {&(0x7f0000002080)}, {&(0x7f0000003080)="9fee4fd30f8f427ae890ad1980fd6bb080b35b8558fd019b8a2342b840ec93aac7dccab9281228", 0x27}, {&(0x7f00000030c0)="f6bdeeffdb82ddc8044dd83729937d82762cad39657e4b0cea770db3f63c437e01d900b30f3a437e8d3acd1078376c678ef2ab291b7c43c650d5647955f526c956f6f90cce1d3132090832728d832bd3d045925305e4a08d62ead5277ade01ecea3b014e04c458679f5831964f964ace0a2ce3a3dc43af25b74556b0a0ad343b91000ab1a94f838352c72db843f23843754c2c448eb5144572b30ab7d27987e9531147", 0xa3}, {0x0}, {&(0x7f00000031c0)}, {&(0x7f0000003200)="b6352b1c", 0x4}], 0x7)
fchdir(r2)
r3 = open(0x0, 0x8000, 0x112)
getdents(r3, 0x0, 0x0)
getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000040)=0x80000001, 0x4)
setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f00000001c0)='wg2\x00', 0x4)
listen(r4, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, r2, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x400)
r5 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x80002)
ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2})
ioctl$VIDIOC_QBUF(r5, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000})
syz_usb_connect(0x4, 0x36, &(0x7f00000032c0)=ANY=[@ANYBLOB="6ffdc8ab76180721be0e4e9a27ad806f8c8199f6fc1525b96b1aaa426856701aabc99fb7e2e15ab641d12f63226ff7b61222ac59e7fc4c22120681487c24079213dc1f89b7d02c03cf07851956aeeb6ee25bc4758331971cee5d2e73f15952400255b3c158b4954130f921fca01d2c4ad65113fb06543b7e50b002b6c10452682953702dd67f50951b1f70374ab2aab233989234572a8e2af3c43e4f3b00cb41c9c83db1afc89335beda9686c924f004879f51d4b51f8c7cf041390cb808eb87d4d738c5f8c0f7130d50722f8a7beb16921fdb744587c6b5410be15ed7c089aaa42879bed2994e36b07c8b5534d7c0e9188dce03c08743109b765aaf402296d60f305c208e54e2b97f25ef2ad153d61879627b2a1bfec94d3f4976aad155dd7fab5dbdf7ade28f2caf4ab01c7d45da20ee9ce878607122aa88d0a08ffba63254073f98b5a112ec91641c47cc2312927e946ced6c152b2901377dbdae018231fa736a9613573edf8306a885654505875c07351ef69ec837a41b84e1299d09ebe1012486d3665e21d88b20412fa2403ad5361fa73c3b447fd1a5a578ba4e20709109e435f0ec8b4d04e8dc07c1db9874e070fe54240432689f383f666cb36c193aaa2bc3f849ae71976a3b3a4157631886e26188bd42a2283c35eaa5b492331ac654b868cc83f52a2cc98b661e6150a4443e7888adae6f708d9864c887f341c08e4cce055acb4a182591ff1364c4e72da5440c483cc4f2804f938e01eccdde89f3643153e6b10ea0b7c94415ada75cf8f927305930724eb4237458ebe76ba11691283b2b0eee6b2693dd167a04d532353249b2093f2cc65ad98eb18b9b34df3b017c5c1763841d4de80f8618e45b82f2be7b0d6192287df84b9db1ebedbcb51f3225a7ed00d8f97f79754be7049894bffe03ad7d6dd0b38033de0d69bd53a9d34db155a85e0d68484ed82bbfcf69398e53edce5ab82184a83b621750f91a2dd9763524bfadd9997399985a3c068ae0b6f08bbe26c94d842dc2486cf1fb45aacb41d9538e5e3c9238435ca622f0663de54d5fe7edbff7121f1ef107daa21e2c926d0c7b2a387542a52e672eeb91abe345472d9da3bb7a58c70866ca0ccb6db06f017c7cd141fdbb068e9f06bd8b67b8f51b1240a6986e77c3e1c3aaa2ec6d31079d21a1ef2cc9c084649fffae20be2b8a2f1ef73eec96327bc10a38c6ba276b094563a6d298940e80daff7edc5dee0bf7b564f78733624e6b8d318630ea3a39019d1b39040e75b8a9a8954ecd693296d60dcf0e1f4e72faa3074915dae3abcbe9c73d9b621f80bc44e55025d98ccfe52867ba9fc2be8a366980cc96d9c1529a3401be83e2b1f60007aee4e77d95fea289e0ac541a5e76113d8f1d7983d90f75c1b81512918d276e5db9e2899b943b80800160808fcaa3bb64dde9d5607010d7ceef3294d7da4a441608faf9c8b53b920c026c61a02e6adde1dd6ecd9a9ffdc51ef073f096ec6aecf03144a00b642f85365263043a13e325f83c7845bb50be817f49d47b0c2a8e98a48d6c29c8043d11754515aa4e9d9b3a4d1dc96887a1617ebad6fd23520a37ae570cc11d9c8ba254104e51abe2968a155e1368016aa93b78fe5ce7b8dd3941020535d24633d847323229ce756a775d2adb1e008135390a4927fe49fb1d0eb9988e811ec31aaf15e0fd327947db8fe6da96d397dcc10e6c0be7a4c4d10346dcd81e7806e47a35434459af0e1f160b2fef4ba560cfd4394b1ed4af889955f257f58ab3da047d1c6dcf74c46693806141a8a23bc64c47ee3d0ece325709df9c33eb093d08a9a4c9aa9f2abcbe8c4cf95ef27f781f4af2e3e3140842272b0e79c8de767938aad4257fb4b6a9ae99b9e37197ae389d359b500ffac60fa5f26376a61b6854e29b35228da4cfde31c23a033caeb7959447cce730cf7f82c040e2c3e04168b54cb4fa3285a7c6e774a1dfcd63feb7bed6cee90a3b12568cca23ecdf5191a3fd1a268dd2623194119c8d514cb105e4c8df7533a10a4ecf53cabda13437e28f7b1daea2f465957845f688e7b341355a98b9e57e411a1e2660d84ce06f9d66b596517439af1a63c14c9b4b04659548654fff37cfb46e44e274e9132e8cc3d897e1f42e3906cf212ca3bda8e8c7edfbfdd3c9b5e729e75797b260c9b2001e868ef261a0d916d4657688d119c86ad39c6cd5d3e26af764dea1e83fa03e43fa66a1635f9ce0f1856cf5b496428a848a066e93f3bb84e39a416dcbbb4027e151ce5091c239c9d7d18ffc279035bc06310af95129420b46f95c930272089c854753b6b18e5dfd07793dd2ebe3616e4da1c11fd782e754f7f8a39839d70a8e49b9532ffb5fe23318907265b9910536d0054acd1b43d5764c54e17a698ca9b7dfe4559251f2a87970b37f93e5fe185a3c6e85ff59e3a55004731f6b756949931e6198411cb5567021962a6c770cbbe26b84fb791e97bc1d752818c0a804788446689b7d3896320f16e7a16db0e9538b8bb79ef797632a68434ff720759edab6a2607b7d1c97e364fd09e48a11f93c5898dbb45925ce22af4522bc093a59d560a542f11572ba4d18ad3bbd8db00856ac6d32460c023334d62b0f5a1c7e4eeb35e27a14b9489871d7f1b30f06d35e3ca26889f30a17dd092807e69fc1543170d1eff23b4802face0cb5e52418518fbf01fb77c7ccd5fb8141e01c827ff916f2da362c173b5782570cd3acae4d47d391eeffe1678bcd31fa33421357810aabf47bddec6d9eafb779f704f024bfac2bc7adf38d9beb2798be8fa94032025425e1dc3b7ed73a4b0eddd7d5ab3a06e0174916f61c185718ea9f60ac33edb7379af99b34fc28f99444258e80a6bd2a5c3555c4354c4c635cadc9d41964b7f4386d8a87c26d461a1446051ecdd8c83c17fd858df8d7bb14360216257f1c2f45635dd9acf5fe904aab9908d2c9a8e309a4865e3af5eda84114a9890287f11d3176c337e26f46c92700306c3aa54c3bfdd92637b322de78e883fd809abe494ac1669c103cc0ee18e66bb8b61ffd6c5c28936ef9daa58c5e101be464c57094860d58f2cd02fc61192b2b72dc72c74d1237163ca177653d9aab2f12063aa71419790988fb723fce32f84d06fad204d1107e124068faace8e5bfc7f2c2bff160842632b4c74cf546434d7a8596c609e7131de6b5942e7dfd9daebd3362d5cf794473deeba593cf494c13b6fa1eb7f11e98a6483cd1c9a17ec9433d69bb71e2612126b706ec35a98bdf9e560527398799f89df351c8c7f5476d9ffdb9960991ec443da66090a4ee9019d7c98c7237bcaa89a7511e404431f178aee267b77dfbe2688b0d1d0aa5a3916ae1d747b9a0e9285fcd1bca4fc2990e3d618a2a98b08a9c6db19cb4dcd9139e5b958067627da4a3d35bbba3f4a91775483db58e67fb42b976978168ce9e1d97a2d0cb69fc12002e213615ae9e3b35426d1b5e60480781216a9086027183f27af6e344a1eaf8eeb61bedd7452a64fc33d84ad5562e02b8a49364b0831258ece730e7ba96fe78a51678d5b5f2b6c3c3bc121949fbc777e28c670d34d890cb5a9538f530143f36827ec68b476fd9a57436d41944b12d60cb48a0a3523cb8afb60e1d78fbb661bf620621cd517eb3dfc2457606371595d17aba9b4dc3d42d0345cc81b9aedb916cb4cbf32555f07686c007e831c269ed1e6aa961c0424bba744159eb0cf307f53724b80cc5c063e240f1f0f4c78ea01bd204a01d973ba5511130e02952a88f48668852d984ae2142d4b0ceb39197968ce199d4e936b9954feaa8a8bff3d7bd6031a425c31a1de0a3c48cc6d8b679546b83031e5f98fa4c900e82fe696d4bcb9aee54bd1f44b6bdb694616a627ae0c43ba9413877818ae881eb53141944028c762b6e15cc26d2aa5db7e44af84bcc1f5b6f0c2c23d0c883f4b224dce73e8c256d8ec4f4c47d49d550f508f4416808374fe64b9cf7cf1443e21973a72f221f3f833232dbc7b2e3bb3764979bcee46bbe76531fe62d548219caa9260692f08ccddb9eb88ed782035702aa00e37b3fec10b161e5f93fd110fa8345cf0c1b9e2ce021de3d0350aafd14155bf30a9d2876ae78d89945dec3cbad988cccd08e4bccb6daa36cfd3d10e9036c47599d80260c3f98da52cd9080e43fc53165c9a67c1d0ace498b227c3b55f9da80dc2057a15a8f3b5b130db1d13828864655f7a7b0fe33f554ac63ec7a63490f2a1dc060f498e47b258bc16ebbf89396ca33bc00e3e14342e04d149432257e9299609b52ced26988b8e5e4ac4e8ea1487b4e871bc3b4c9315c9d2e63397e66be29f592f8469ed52defb02f844a80ba58426fffd78509f22f3d9c6689cf143ea7df4d4cf105784e413cd6c5407735f513234cc883897b6a371c6998bce24638dc8e663920dcec5344bd2b1f9b0c5b93225d4039d9ac532b4633dfab858741ea9ff77ca426604f5940ec27dda7a2e7b5c3cb6a108298dfd86edadfba1230427f8d5bd142d7c5606287555d084a00e41606b214da562e029eab4da646f2e6705ac686384dfb68e60b2938f2ede3be86106e1bd9c82d4aa950c75f1320d372341a6878364abe35511a05f9f5c9fb2720b45b400a46130884e14a047865461ddd3a684798e64d977a6d24dbb5364a4dc774693a411f8f2a8c339a2cdea8ffc92f3166d541273d9518204d357afdc75e860f7541285f00441139c481adcf733b07364ebaadd279b84a459c707614e813b8962afbf46791f391ef79b051a2eb132193adf86e441350a8d6da44488c6984663aeb016b4e77ad0159e109b2ef9de5e1ab892a5281a1e1e3a21291d0d77b99ca2304139facc645a0d38b73c8ee908a5d1e1a5b6739f5ee56562b8ec10d0e944a0c28b362643363923b003fe3358a4e58e7c107968f19423eb3009047e61803e0f4a0969353ec274907e9663c4398e1d29b6b612576f0a4f9222960a4f2e49f1fcda63548c5968bec2cbd72f733d9e42a8dfcb4dd8b6d20471dbb9dd109e52a5da36bce113f636ba148b7b0fe3172a046a2f4465b99c1eab9c78eae3a8f7a37f1b577bccce8d83cc80d74f99866782aa7963a9301885398288c5e4f431c8b6bce9e008176adb65afc8c26e9850a470d924a308a974735645d19a85f95fef07ab46a0ffb7f8908c81ada337772abc6e8eb2564e093639416822e49923837391d9f3aedf92a2a06abd313dfaef75aa690d87203516090b13f93e10f61380866c68071426723ebc270588d7294267df054cd269b8fec82411fb6d7f92b5e7f41e5e27a4401406f3c6d6e85e7e03ccc6d59ee80eb1d3bb9b43b818af31143e3e57f979667d671a80ed07c67fd081ab722261fad297878208bf6ed73821b7a4234befa3140108f34b970bef36b62e4c4ef56852329a41c0ca84977ca81aa9ee2eff8b0b4bdce0e89e36b3a8026a2ce0d02ae525a2dae068b1e2a56cd076ac3938d98df03d645d91491d8797390d7b4893a68a637e59967c44430c82068db20cf580f81fc8472aa2671c297f846860895c71fab1b3f5023bd1e21e8670fad753a094cf761668c3f93a7a64f46b0f662ab724154eef49bcca3e250f0708355c2df6e5e26026ef7b8f183432e0d926104241b875a2d69b1ab373b6b4732d1ba218f02568fb92806dd642f427998e0ab1afb6422906ba59782e250200f8017b8b7b766387df2948bc901ff540f0cfdbcffd46e439eb1f1ce0f67966426a7f5be15294c6c3348618bddab841e32eeb2665004908ca5bb38d6a0a977f824bf83b248fcc8d04a", @ANYRESHEX=r0], 0x0)
ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2})
r6 = add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)='[', 0xfeed, 0xffffffffffffffff)
keyctl$revoke(0x3, r6)
ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f00000001c0)=0x2)
ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f0000000200)=0x1)
executing program 4:
syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650caa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94)
r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x2, 0x4, 0x200, 0x0, {0x77359400}, {0x1, 0x2, 0x0, 0x0, 0x0, 0xfe, "05000100"}, 0x0, 0x2, {}, 0x20800})
write$binfmt_misc(r1, &(0x7f0000000040), 0xe09)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x80000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x31]}})
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="120000000100000004"], 0x50)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000240), 0x3)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "7c98b307afa2738e", "9797fed914ba965b281cbe8c9b39e729", "049cee36", "90993a510db0b184"}, 0x28)
writev(r0, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x100000000000027b)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff3, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0xe38, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x40010)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <29>
bisect: split chunk #0 of len 29 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 7, 7, 29, 7, 6, 7, 30, 7, 6, 7, 7, 7, 7, 7, 30, 7, 7, 6, 7]
detailed listing:
executing program 0:
socket$inet_tcp(0x2, 0x1, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x10)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xd70, 0x1f280, 0x0, 0x1c7})
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00')
io_uring_enter(r0, 0x100, 0x11, 0x1f, 0x0, 0x0)
executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
writev(r0, &(0x7f0000000240)=[{&(0x7f0000000280)="0232e6fe", 0x4}], 0x1)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0)
ioctl$FS_IOC_READ_VERITY_METADATA(0xffffffffffffffff, 0xc0286687, 0x0)
r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r1)
ptrace$poke(0x5, r1, &(0x7f00000001c0), 0x7)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4)
connect$inet(r0, &(0x7f00000006c0)={0x2, 0x0, @dev}, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)={0x14, 0x10, 0x21, 0xfffffffd, 0x0, {0x3}}, 0x14}}, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000180)=0x2, 0x4)
sendmmsg$inet(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000005c0)="b8", 0x1}], 0x1}, 0xa6}], 0x1, 0x4008440)
executing program 2:
syz_open_dev$video4linux(&(0x7f0000000000), 0xb7c, 0x100)
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x9d49, 0x400, 0x2, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x240, 0x0)
ioctl$XFS_IOC_COMMIT_RANGE(0xffffffffffffffff, 0x40585883, &(0x7f00000001c0)={r4, 0x0, 0xfffffffffffff206, 0x3, 0x2a98, 0x2, [0x401, 0x6, 0x8, 0x0, 0x8, 0x1000]})
set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x3)
r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r5, 0x0, 0x0)
syz_usb_control_io$hid(r5, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff)
close(r7)
execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r10, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0xeeee8000, 0xf000, 0x7, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x1, 0xddccb000, 0xd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1}, {0x118004, 0xdddd8000, 0x18, 0xe, 0x0, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x6}, {0x10b002, 0x2000, 0xc, 0xfd, 0x80, 0x0, 0x1}, {0x1000, 0x0, 0xd, 0x8, 0x70, 0x80, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0x100026fff, 0xeeef0000, 0x8, 0x4, 0x0, 0x8, 0x0, 0x0, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0x10000, 0xf, 0x0, 0x5, 0x0, 0x0, 0x81, 0x0, 0x4}, {0xd000, 0x41000, 0x3, 0x82, 0xfc, 0x10, 0x4, 0xe}, {0x0, 0x800}, {0x1, 0xfffe}, 0x40000010, 0x0, 0x0, 0x10, 0x1000000000000001, 0x0, 0x900, [0x0, 0x0, 0x2, 0x5]})
ioctl$KVM_RUN(r10, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r10, 0x4140aecd, &(0x7f0000000100))
r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003c00), r6)
sendmsg$ETHTOOL_MSG_EEE_SET(r6, &(0x7f00000040c0)={0x0, 0x0, &(0x7f0000004080)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010026bd7000ffdbdf2518000000180001801400020067656e65766530000000000000000000d9de2b7491b4eeb7099957387d802f278da6f0073b8270e2dbd992e5d083c29c567d8a86ab37553ac0549039195ee96d7a7fcfb7c586260aba7a4d82fe0f1565dc125505ad1f06d7efe6eae2b510296d2f01ea0551713b016a537fa6674ffb188e9050ddd52316ccfed7ec064d47f89f63d0f36c135a2d29ac2265769683ddc249b58e9d28e90a2303da229941820c74413370379b99156f5d30535b21a1bd2265a3876b9281c0e68a1596a36c8be01b262ca53d7aeff5dd3e5f5fa5ca29c2aed958fba697ba6ae227ced4571e34a3fb6078ceb1ddb62a412c5e981aa9fcec4b8c2ae09ba2be4876d569ca4222d334e45c1a23c0b34bbcc8a349bd0000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x40008000)
r12 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r12, 0x81044804, 0x0)
set_mempolicy(0x4000, &(0x7f0000000080)=0xc00, 0xffffffffffffb176)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x21800, 0x0)
accept$alg(0xffffffffffffffff, 0x0, 0x0)
r13 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
executing program 0:
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e20, 0x1000, @local, 0x7ff}}, 0x9, 0x3, 0x9, 0x7fffffff, 0x8}, &(0x7f0000000280)=0x98)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x40000070, 0x0, 0x400006}]})
executing program 0:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0)
socket$kcm(0x10, 0x2, 0x0)
ioctl$DVB_DEMUX_DMX_GET_STC(0xffffffffffffffff, 0xc0106f32, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000040)=ANY=[@ANYBLOB="200f11000000", @ANYRES16=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0)
executing program 1:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff})
connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4)
socket$can_raw(0x1d, 0x3, 0x1)
sendmmsg$inet(r3, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c)
connect$inet6(r4, &(0x7f0000000000)={0x2, 0x4e23, 0x0, @mcast1, 0x4}, 0x1c)
r5 = socket$netlink(0x10, 0x3, 0x8000000004)
connect$inet6(r4, &(0x7f0000000800)={0xa, 0x4e24, 0xc0, @ipv4={'\x00', '\xff\xff', @loopback}, 0xc58e}, 0x1c)
writev(r5, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac710aa7d0000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1)
syz_open_dev$sg(0x0, 0x0, 0x40100)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x4)
preadv(r5, &(0x7f00000022c0)=[{&(0x7f00000006c0)=""/73, 0x49}, {&(0x7f0000000740)=""/155, 0x9b}, {&(0x7f0000000840)=""/239, 0xef}, {&(0x7f0000000940)=""/247, 0xf7}, {&(0x7f0000000a40)=""/166, 0xa6}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000001240)=""/4096, 0x1000}], 0x7, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'bridge_slave_1\x00', @link_local})
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={0xffffffffffffffff, 0x0, &(0x7f0000000640)=""/13, 0x2}, 0x20)
r7 = socket$netlink(0x10, 0x3, 0x0)
writev(r7, &(0x7f0000000e00)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}, {&(0x7f0000000c00)="f089544272076c4d41fd398602b89b3fa3a9c58c88fe7b2196418b996d0900ab2acfaec9736958e9251d2dc35428a4d9f2e99383bbd12a723adde1215cba8da2fdc128a0c03d99353c90f9872df89d9e17fe616960fa65b29a328c5a3ad12eef1b1c40dd6095277b3a3af49cb421ea7b54e04a5a4b3e69355c5990305623ead4c316857b5b0c02a2bc26238cb7570e5771d92572ae7a25d7ef3016422e47328807aa0d756af338ede7940af5c81003a1fd00a3f5", 0xb4}, {&(0x7f0000000d00)="8d2aadf53c167444d7ecf2ff4aebc7af0637ef9c57778a567de1ae283b63a457869d734c1a43768ad2ca13eebce8a40a3c3fc64f933b80aa681e48449e7cdb3dc8577006b9532ea431e2bc35239518388132f7b03ba7530aca3d55738e10823d67cfc4f779f3334bc2a00212772e14650115b553ec39d5a1d117343fed6e80a0bc8883e526252e9278d4d8a8bc56e59fd506dafe2b695add69459918b0acd7657b53a6bd1da27dd5244e2acbd72f315ffefc3212c7d5ee2ddeadef0c1027d554834014d0641099407b62ed00fe72eacde224fce85be583b7c35e2747763b8f5926", 0xe1}], 0x3)
sendto$inet(r3, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
madvise(&(0x7f00000ee000/0x2000)=nil, 0x2000, 0x8)
readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/13, 0xd}, {&(0x7f0000000180)=""/15, 0x13}], 0x1d)
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0xb81, 0x0)
close(r0)
close(0xffffffffffffffff)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x3, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x4}]}], {0x14}}, 0x90}}, 0x40000)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6)
ioctl$TUNGETVNETLE(r0, 0x40107447, &(0x7f0000000180))
executing program 4:
openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/timer_list\x00', 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
ptrace$poke(0x5, r0, &(0x7f0000000040), 0x6)
executing program 4:
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r0 = socket(0x840000000002, 0x3, 0xff)
sendmsg$inet(r0, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000040)="9744012000000000035bdb61ea02df7bc728d08701008cc5595c08ff", 0x1c}], 0x1, &(0x7f00000008c0)}, 0xc884)
r1 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80081}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0x0, 0x9}, {0xfff3, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IP_TOS={0x5, 0x50, 0x5e}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0)
executing program 4:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="020000000400000004"], 0x50)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x64)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325})
bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x5, @remote, 0x6e}, 0x1c)
io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8101, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0xfffffffe, 0x0, "0062ba7d82000000000000000000f7fffeff00"})
r1 = syz_open_pts(r0, 0x8182)
dup3(r1, r0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x9a1, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5c, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x20005, 0x7, 0x5, 0x8006, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x3ff, 0x5, 0x3e, 0x18a, 0x5, 0x6, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0xa, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0xf, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x16, 0x400, 0x9, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x9, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x1, 0x6, 0x101, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x13, 0x3, 0x4000009, 0x6, 0x4000000, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x80004, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x8002, 0x0, 0x9, 0xb, 0x4, 0x45, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x2000000b, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0x9e, 0x4, 0xa9, 0x5, 0x0, 0xac8, 0xbf, 0x2, 0x80, 0x7ff, 0x12b, 0x1, 0xc921, 0xa, 0xffffffff, 0x5, 0x2, 0x1, 0x807ff, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x1938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x6, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x25, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0xf1, 0x803, 0xd7, 0x7fff, 0xfffffffa, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)
executing program 2:
bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0)
r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
timer_create(0x7, &(0x7f0000000240)={0x0, 0x21, 0x2}, 0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x8})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0)
r2 = fsmount(r1, 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f0000003240)=[{&(0x7f0000000340)="47dad0e3466af430e94c4c6e8e2a5400bbc61fd54e31bc1836c40e7ea2601c5ddaf3ca645b13d2ed95e2e9e35b5c4920fb52ce60a7811c8a58a43c9abc2a44a197bb95ae8b156658daaff8ee34fc548b64ab36fe520906ffc1bd6d5cd0b6c368d3149a18ec658cd5cd210eae8ac8a97f2be2fbb013425a120995a4aa59bbb862e11cb5a1ed7322588d898e3caa68", 0x8e}, {&(0x7f0000002080)}, {&(0x7f0000003080)="9fee4fd30f8f427ae890ad1980fd6bb080b35b8558fd019b8a2342b840ec93aac7dccab9281228", 0x27}, {&(0x7f00000030c0)="f6bdeeffdb82ddc8044dd83729937d82762cad39657e4b0cea770db3f63c437e01d900b30f3a437e8d3acd1078376c678ef2ab291b7c43c650d5647955f526c956f6f90cce1d3132090832728d832bd3d045925305e4a08d62ead5277ade01ecea3b014e04c458679f5831964f964ace0a2ce3a3dc43af25b74556b0a0ad343b91000ab1a94f838352c72db843f23843754c2c448eb5144572b30ab7d27987e9531147", 0xa3}, {0x0}, {&(0x7f00000031c0)}, {&(0x7f0000003200)="b6352b1c", 0x4}], 0x7)
fchdir(r2)
r3 = open(0x0, 0x8000, 0x112)
getdents(r3, 0x0, 0x0)
getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000040)=0x80000001, 0x4)
setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f00000001c0)='wg2\x00', 0x4)
listen(r4, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, r2, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x400)
r5 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x80002)
ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2})
ioctl$VIDIOC_QBUF(r5, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000})
syz_usb_connect(0x4, 0x36, &(0x7f00000032c0)=ANY=[@ANYBLOB="6ffdc8ab76180721be0e4e9a27ad806f8c8199f6fc1525b96b1aaa426856701aabc99fb7e2e15ab641d12f63226ff7b61222ac59e7fc4c22120681487c24079213dc1f89b7d02c03cf07851956aeeb6ee25bc4758331971cee5d2e73f15952400255b3c158b4954130f921fca01d2c4ad65113fb06543b7e50b002b6c10452682953702dd67f50951b1f70374ab2aab233989234572a8e2af3c43e4f3b00cb41c9c83db1afc89335beda9686c924f004879f51d4b51f8c7cf041390cb808eb87d4d738c5f8c0f7130d50722f8a7beb16921fdb744587c6b5410be15ed7c089aaa42879bed2994e36b07c8b5534d7c0e9188dce03c08743109b765aaf402296d60f305c208e54e2b97f25ef2ad153d61879627b2a1bfec94d3f4976aad155dd7fab5dbdf7ade28f2caf4ab01c7d45da20ee9ce878607122aa88d0a08ffba63254073f98b5a112ec91641c47cc2312927e946ced6c152b2901377dbdae018231fa736a9613573edf8306a885654505875c07351ef69ec837a41b84e1299d09ebe1012486d3665e21d88b20412fa2403ad5361fa73c3b447fd1a5a578ba4e20709109e435f0ec8b4d04e8dc07c1db9874e070fe54240432689f383f666cb36c193aaa2bc3f849ae71976a3b3a4157631886e26188bd42a2283c35eaa5b492331ac654b868cc83f52a2cc98b661e6150a4443e7888adae6f708d9864c887f341c08e4cce055acb4a182591ff1364c4e72da5440c483cc4f2804f938e01eccdde89f3643153e6b10ea0b7c94415ada75cf8f927305930724eb4237458ebe76ba11691283b2b0eee6b2693dd167a04d532353249b2093f2cc65ad98eb18b9b34df3b017c5c1763841d4de80f8618e45b82f2be7b0d6192287df84b9db1ebedbcb51f3225a7ed00d8f97f79754be7049894bffe03ad7d6dd0b38033de0d69bd53a9d34db155a85e0d68484ed82bbfcf69398e53edce5ab82184a83b621750f91a2dd9763524bfadd9997399985a3c068ae0b6f08bbe26c94d842dc2486cf1fb45aacb41d9538e5e3c9238435ca622f0663de54d5fe7edbff7121f1ef107daa21e2c926d0c7b2a387542a52e672eeb91abe345472d9da3bb7a58c70866ca0ccb6db06f017c7cd141fdbb068e9f06bd8b67b8f51b1240a6986e77c3e1c3aaa2ec6d31079d21a1ef2cc9c084649fffae20be2b8a2f1ef73eec96327bc10a38c6ba276b094563a6d298940e80daff7edc5dee0bf7b564f78733624e6b8d318630ea3a39019d1b39040e75b8a9a8954ecd693296d60dcf0e1f4e72faa3074915dae3abcbe9c73d9b621f80bc44e55025d98ccfe52867ba9fc2be8a366980cc96d9c1529a3401be83e2b1f60007aee4e77d95fea289e0ac541a5e76113d8f1d7983d90f75c1b81512918d276e5db9e2899b943b80800160808fcaa3bb64dde9d5607010d7ceef3294d7da4a441608faf9c8b53b920c026c61a02e6adde1dd6ecd9a9ffdc51ef073f096ec6aecf03144a00b642f85365263043a13e325f83c7845bb50be817f49d47b0c2a8e98a48d6c29c8043d11754515aa4e9d9b3a4d1dc96887a1617ebad6fd23520a37ae570cc11d9c8ba254104e51abe2968a155e1368016aa93b78fe5ce7b8dd3941020535d24633d847323229ce756a775d2adb1e008135390a4927fe49fb1d0eb9988e811ec31aaf15e0fd327947db8fe6da96d397dcc10e6c0be7a4c4d10346dcd81e7806e47a35434459af0e1f160b2fef4ba560cfd4394b1ed4af889955f257f58ab3da047d1c6dcf74c46693806141a8a23bc64c47ee3d0ece325709df9c33eb093d08a9a4c9aa9f2abcbe8c4cf95ef27f781f4af2e3e3140842272b0e79c8de767938aad4257fb4b6a9ae99b9e37197ae389d359b500ffac60fa5f26376a61b6854e29b35228da4cfde31c23a033caeb7959447cce730cf7f82c040e2c3e04168b54cb4fa3285a7c6e774a1dfcd63feb7bed6cee90a3b12568cca23ecdf5191a3fd1a268dd2623194119c8d514cb105e4c8df7533a10a4ecf53cabda13437e28f7b1daea2f465957845f688e7b341355a98b9e57e411a1e2660d84ce06f9d66b596517439af1a63c14c9b4b04659548654fff37cfb46e44e274e9132e8cc3d897e1f42e3906cf212ca3bda8e8c7edfbfdd3c9b5e729e75797b260c9b2001e868ef261a0d916d4657688d119c86ad39c6cd5d3e26af764dea1e83fa03e43fa66a1635f9ce0f1856cf5b496428a848a066e93f3bb84e39a416dcbbb4027e151ce5091c239c9d7d18ffc279035bc06310af95129420b46f95c930272089c854753b6b18e5dfd07793dd2ebe3616e4da1c11fd782e754f7f8a39839d70a8e49b9532ffb5fe23318907265b9910536d0054acd1b43d5764c54e17a698ca9b7dfe4559251f2a87970b37f93e5fe185a3c6e85ff59e3a55004731f6b756949931e6198411cb5567021962a6c770cbbe26b84fb791e97bc1d752818c0a804788446689b7d3896320f16e7a16db0e9538b8bb79ef797632a68434ff720759edab6a2607b7d1c97e364fd09e48a11f93c5898dbb45925ce22af4522bc093a59d560a542f11572ba4d18ad3bbd8db00856ac6d32460c023334d62b0f5a1c7e4eeb35e27a14b9489871d7f1b30f06d35e3ca26889f30a17dd092807e69fc1543170d1eff23b4802face0cb5e52418518fbf01fb77c7ccd5fb8141e01c827ff916f2da362c173b5782570cd3acae4d47d391eeffe1678bcd31fa33421357810aabf47bddec6d9eafb779f704f024bfac2bc7adf38d9beb2798be8fa94032025425e1dc3b7ed73a4b0eddd7d5ab3a06e0174916f61c185718ea9f60ac33edb7379af99b34fc28f99444258e80a6bd2a5c3555c4354c4c635cadc9d41964b7f4386d8a87c26d461a1446051ecdd8c83c17fd858df8d7bb14360216257f1c2f45635dd9acf5fe904aab9908d2c9a8e309a4865e3af5eda84114a9890287f11d3176c337e26f46c92700306c3aa54c3bfdd92637b322de78e883fd809abe494ac1669c103cc0ee18e66bb8b61ffd6c5c28936ef9daa58c5e101be464c57094860d58f2cd02fc61192b2b72dc72c74d1237163ca177653d9aab2f12063aa71419790988fb723fce32f84d06fad204d1107e124068faace8e5bfc7f2c2bff160842632b4c74cf546434d7a8596c609e7131de6b5942e7dfd9daebd3362d5cf794473deeba593cf494c13b6fa1eb7f11e98a6483cd1c9a17ec9433d69bb71e2612126b706ec35a98bdf9e560527398799f89df351c8c7f5476d9ffdb9960991ec443da66090a4ee9019d7c98c7237bcaa89a7511e404431f178aee267b77dfbe2688b0d1d0aa5a3916ae1d747b9a0e9285fcd1bca4fc2990e3d618a2a98b08a9c6db19cb4dcd9139e5b958067627da4a3d35bbba3f4a91775483db58e67fb42b976978168ce9e1d97a2d0cb69fc12002e213615ae9e3b35426d1b5e60480781216a9086027183f27af6e344a1eaf8eeb61bedd7452a64fc33d84ad5562e02b8a49364b0831258ece730e7ba96fe78a51678d5b5f2b6c3c3bc121949fbc777e28c670d34d890cb5a9538f530143f36827ec68b476fd9a57436d41944b12d60cb48a0a3523cb8afb60e1d78fbb661bf620621cd517eb3dfc2457606371595d17aba9b4dc3d42d0345cc81b9aedb916cb4cbf32555f07686c007e831c269ed1e6aa961c0424bba744159eb0cf307f53724b80cc5c063e240f1f0f4c78ea01bd204a01d973ba5511130e02952a88f48668852d984ae2142d4b0ceb39197968ce199d4e936b9954feaa8a8bff3d7bd6031a425c31a1de0a3c48cc6d8b679546b83031e5f98fa4c900e82fe696d4bcb9aee54bd1f44b6bdb694616a627ae0c43ba9413877818ae881eb53141944028c762b6e15cc26d2aa5db7e44af84bcc1f5b6f0c2c23d0c883f4b224dce73e8c256d8ec4f4c47d49d550f508f4416808374fe64b9cf7cf1443e21973a72f221f3f833232dbc7b2e3bb3764979bcee46bbe76531fe62d548219caa9260692f08ccddb9eb88ed782035702aa00e37b3fec10b161e5f93fd110fa8345cf0c1b9e2ce021de3d0350aafd14155bf30a9d2876ae78d89945dec3cbad988cccd08e4bccb6daa36cfd3d10e9036c47599d80260c3f98da52cd9080e43fc53165c9a67c1d0ace498b227c3b55f9da80dc2057a15a8f3b5b130db1d13828864655f7a7b0fe33f554ac63ec7a63490f2a1dc060f498e47b258bc16ebbf89396ca33bc00e3e14342e04d149432257e9299609b52ced26988b8e5e4ac4e8ea1487b4e871bc3b4c9315c9d2e63397e66be29f592f8469ed52defb02f844a80ba58426fffd78509f22f3d9c6689cf143ea7df4d4cf105784e413cd6c5407735f513234cc883897b6a371c6998bce24638dc8e663920dcec5344bd2b1f9b0c5b93225d4039d9ac532b4633dfab858741ea9ff77ca426604f5940ec27dda7a2e7b5c3cb6a108298dfd86edadfba1230427f8d5bd142d7c5606287555d084a00e41606b214da562e029eab4da646f2e6705ac686384dfb68e60b2938f2ede3be86106e1bd9c82d4aa950c75f1320d372341a6878364abe35511a05f9f5c9fb2720b45b400a46130884e14a047865461ddd3a684798e64d977a6d24dbb5364a4dc774693a411f8f2a8c339a2cdea8ffc92f3166d541273d9518204d357afdc75e860f7541285f00441139c481adcf733b07364ebaadd279b84a459c707614e813b8962afbf46791f391ef79b051a2eb132193adf86e441350a8d6da44488c6984663aeb016b4e77ad0159e109b2ef9de5e1ab892a5281a1e1e3a21291d0d77b99ca2304139facc645a0d38b73c8ee908a5d1e1a5b6739f5ee56562b8ec10d0e944a0c28b362643363923b003fe3358a4e58e7c107968f19423eb3009047e61803e0f4a0969353ec274907e9663c4398e1d29b6b612576f0a4f9222960a4f2e49f1fcda63548c5968bec2cbd72f733d9e42a8dfcb4dd8b6d20471dbb9dd109e52a5da36bce113f636ba148b7b0fe3172a046a2f4465b99c1eab9c78eae3a8f7a37f1b577bccce8d83cc80d74f99866782aa7963a9301885398288c5e4f431c8b6bce9e008176adb65afc8c26e9850a470d924a308a974735645d19a85f95fef07ab46a0ffb7f8908c81ada337772abc6e8eb2564e093639416822e49923837391d9f3aedf92a2a06abd313dfaef75aa690d87203516090b13f93e10f61380866c68071426723ebc270588d7294267df054cd269b8fec82411fb6d7f92b5e7f41e5e27a4401406f3c6d6e85e7e03ccc6d59ee80eb1d3bb9b43b818af31143e3e57f979667d671a80ed07c67fd081ab722261fad297878208bf6ed73821b7a4234befa3140108f34b970bef36b62e4c4ef56852329a41c0ca84977ca81aa9ee2eff8b0b4bdce0e89e36b3a8026a2ce0d02ae525a2dae068b1e2a56cd076ac3938d98df03d645d91491d8797390d7b4893a68a637e59967c44430c82068db20cf580f81fc8472aa2671c297f846860895c71fab1b3f5023bd1e21e8670fad753a094cf761668c3f93a7a64f46b0f662ab724154eef49bcca3e250f0708355c2df6e5e26026ef7b8f183432e0d926104241b875a2d69b1ab373b6b4732d1ba218f02568fb92806dd642f427998e0ab1afb6422906ba59782e250200f8017b8b7b766387df2948bc901ff540f0cfdbcffd46e439eb1f1ce0f67966426a7f5be15294c6c3348618bddab841e32eeb2665004908ca5bb38d6a0a977f824bf83b248fcc8d04a", @ANYRESHEX=r0], 0x0)
ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2})
r6 = add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)='[', 0xfeed, 0xffffffffffffffff)
keyctl$revoke(0x3, r6)
ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f00000001c0)=0x2)
ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f0000000200)=0x1)
executing program 4:
syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650caa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94)
r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x2, 0x4, 0x200, 0x0, {0x77359400}, {0x1, 0x2, 0x0, 0x0, 0x0, 0xfe, "05000100"}, 0x0, 0x2, {}, 0x20800})
write$binfmt_misc(r1, &(0x7f0000000040), 0xe09)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x80000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x31]}})
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="120000000100000004"], 0x50)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000240), 0x3)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "7c98b307afa2738e", "9797fed914ba965b281cbe8c9b39e729", "049cee36", "90993a510db0b184"}, 0x28)
writev(r0, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x100000000000027b)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff3, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0xe38, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x40010)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 7, 7, 7, 7, 30, 7, 7, 6, 7]
detailed listing:
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0xb81, 0x0)
close(r0)
close(0xffffffffffffffff)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x3, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x4}]}], {0x14}}, 0x90}}, 0x40000)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6)
ioctl$TUNGETVNETLE(r0, 0x40107447, &(0x7f0000000180))
executing program 4:
openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/timer_list\x00', 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
ptrace$poke(0x5, r0, &(0x7f0000000040), 0x6)
executing program 4:
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r0 = socket(0x840000000002, 0x3, 0xff)
sendmsg$inet(r0, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000040)="9744012000000000035bdb61ea02df7bc728d08701008cc5595c08ff", 0x1c}], 0x1, &(0x7f00000008c0)}, 0xc884)
r1 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80081}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0x0, 0x9}, {0xfff3, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IP_TOS={0x5, 0x50, 0x5e}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0)
executing program 4:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="020000000400000004"], 0x50)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x64)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325})
bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x5, @remote, 0x6e}, 0x1c)
io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0)
executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8101, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0xfffffffe, 0x0, "0062ba7d82000000000000000000f7fffeff00"})
r1 = syz_open_pts(r0, 0x8182)
dup3(r1, r0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x9a1, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5c, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x20005, 0x7, 0x5, 0x8006, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x3ff, 0x5, 0x3e, 0x18a, 0x5, 0x6, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0xa, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0xf, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x16, 0x400, 0x9, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x9, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x1, 0x6, 0x101, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x13, 0x3, 0x4000009, 0x6, 0x4000000, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x80004, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x8002, 0x0, 0x9, 0xb, 0x4, 0x45, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x2000000b, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0x9e, 0x4, 0xa9, 0x5, 0x0, 0xac8, 0xbf, 0x2, 0x80, 0x7ff, 0x12b, 0x1, 0xc921, 0xa, 0xffffffff, 0x5, 0x2, 0x1, 0x807ff, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x1938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x6, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x25, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0xf1, 0x803, 0xd7, 0x7fff, 0xfffffffa, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)
executing program 2:
bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0)
r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
timer_create(0x7, &(0x7f0000000240)={0x0, 0x21, 0x2}, 0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x8})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000)
r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0)
r2 = fsmount(r1, 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f0000003240)=[{&(0x7f0000000340)="47dad0e3466af430e94c4c6e8e2a5400bbc61fd54e31bc1836c40e7ea2601c5ddaf3ca645b13d2ed95e2e9e35b5c4920fb52ce60a7811c8a58a43c9abc2a44a197bb95ae8b156658daaff8ee34fc548b64ab36fe520906ffc1bd6d5cd0b6c368d3149a18ec658cd5cd210eae8ac8a97f2be2fbb013425a120995a4aa59bbb862e11cb5a1ed7322588d898e3caa68", 0x8e}, {&(0x7f0000002080)}, {&(0x7f0000003080)="9fee4fd30f8f427ae890ad1980fd6bb080b35b8558fd019b8a2342b840ec93aac7dccab9281228", 0x27}, {&(0x7f00000030c0)="f6bdeeffdb82ddc8044dd83729937d82762cad39657e4b0cea770db3f63c437e01d900b30f3a437e8d3acd1078376c678ef2ab291b7c43c650d5647955f526c956f6f90cce1d3132090832728d832bd3d045925305e4a08d62ead5277ade01ecea3b014e04c458679f5831964f964ace0a2ce3a3dc43af25b74556b0a0ad343b91000ab1a94f838352c72db843f23843754c2c448eb5144572b30ab7d27987e9531147", 0xa3}, {0x0}, {&(0x7f00000031c0)}, {&(0x7f0000003200)="b6352b1c", 0x4}], 0x7)
fchdir(r2)
r3 = open(0x0, 0x8000, 0x112)
getdents(r3, 0x0, 0x0)
getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000040)=0x80000001, 0x4)
setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f00000001c0)='wg2\x00', 0x4)
listen(r4, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, r2, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x400)
r5 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x80002)
ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000040)={0x1, 0x2, 0x2})
ioctl$VIDIOC_QBUF(r5, 0xc058560f, &(0x7f00000000c0)=@userptr={0x0, 0x2, 0x2c, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000001000)}, 0x400000})
syz_usb_connect(0x4, 0x36, &(0x7f00000032c0)=ANY=[@ANYBLOB="6ffdc8ab76180721be0e4e9a27ad806f8c8199f6fc1525b96b1aaa426856701aabc99fb7e2e15ab641d12f63226ff7b61222ac59e7fc4c22120681487c24079213dc1f89b7d02c03cf07851956aeeb6ee25bc4758331971cee5d2e73f15952400255b3c158b4954130f921fca01d2c4ad65113fb06543b7e50b002b6c10452682953702dd67f50951b1f70374ab2aab233989234572a8e2af3c43e4f3b00cb41c9c83db1afc89335beda9686c924f004879f51d4b51f8c7cf041390cb808eb87d4d738c5f8c0f7130d50722f8a7beb16921fdb744587c6b5410be15ed7c089aaa42879bed2994e36b07c8b5534d7c0e9188dce03c08743109b765aaf402296d60f305c208e54e2b97f25ef2ad153d61879627b2a1bfec94d3f4976aad155dd7fab5dbdf7ade28f2caf4ab01c7d45da20ee9ce878607122aa88d0a08ffba63254073f98b5a112ec91641c47cc2312927e946ced6c152b2901377dbdae018231fa736a9613573edf8306a885654505875c07351ef69ec837a41b84e1299d09ebe1012486d3665e21d88b20412fa2403ad5361fa73c3b447fd1a5a578ba4e20709109e435f0ec8b4d04e8dc07c1db9874e070fe54240432689f383f666cb36c193aaa2bc3f849ae71976a3b3a4157631886e26188bd42a2283c35eaa5b492331ac654b868cc83f52a2cc98b661e6150a4443e7888adae6f708d9864c887f341c08e4cce055acb4a182591ff1364c4e72da5440c483cc4f2804f938e01eccdde89f3643153e6b10ea0b7c94415ada75cf8f927305930724eb4237458ebe76ba11691283b2b0eee6b2693dd167a04d532353249b2093f2cc65ad98eb18b9b34df3b017c5c1763841d4de80f8618e45b82f2be7b0d6192287df84b9db1ebedbcb51f3225a7ed00d8f97f79754be7049894bffe03ad7d6dd0b38033de0d69bd53a9d34db155a85e0d68484ed82bbfcf69398e53edce5ab82184a83b621750f91a2dd9763524bfadd9997399985a3c068ae0b6f08bbe26c94d842dc2486cf1fb45aacb41d9538e5e3c9238435ca622f0663de54d5fe7edbff7121f1ef107daa21e2c926d0c7b2a387542a52e672eeb91abe345472d9da3bb7a58c70866ca0ccb6db06f017c7cd141fdbb068e9f06bd8b67b8f51b1240a6986e77c3e1c3aaa2ec6d31079d21a1ef2cc9c084649fffae20be2b8a2f1ef73eec96327bc10a38c6ba276b094563a6d298940e80daff7edc5dee0bf7b564f78733624e6b8d318630ea3a39019d1b39040e75b8a9a8954ecd693296d60dcf0e1f4e72faa3074915dae3abcbe9c73d9b621f80bc44e55025d98ccfe52867ba9fc2be8a366980cc96d9c1529a3401be83e2b1f60007aee4e77d95fea289e0ac541a5e76113d8f1d7983d90f75c1b81512918d276e5db9e2899b943b80800160808fcaa3bb64dde9d5607010d7ceef3294d7da4a441608faf9c8b53b920c026c61a02e6adde1dd6ecd9a9ffdc51ef073f096ec6aecf03144a00b642f85365263043a13e325f83c7845bb50be817f49d47b0c2a8e98a48d6c29c8043d11754515aa4e9d9b3a4d1dc96887a1617ebad6fd23520a37ae570cc11d9c8ba254104e51abe2968a155e1368016aa93b78fe5ce7b8dd3941020535d24633d847323229ce756a775d2adb1e008135390a4927fe49fb1d0eb9988e811ec31aaf15e0fd327947db8fe6da96d397dcc10e6c0be7a4c4d10346dcd81e7806e47a35434459af0e1f160b2fef4ba560cfd4394b1ed4af889955f257f58ab3da047d1c6dcf74c46693806141a8a23bc64c47ee3d0ece325709df9c33eb093d08a9a4c9aa9f2abcbe8c4cf95ef27f781f4af2e3e3140842272b0e79c8de767938aad4257fb4b6a9ae99b9e37197ae389d359b500ffac60fa5f26376a61b6854e29b35228da4cfde31c23a033caeb7959447cce730cf7f82c040e2c3e04168b54cb4fa3285a7c6e774a1dfcd63feb7bed6cee90a3b12568cca23ecdf5191a3fd1a268dd2623194119c8d514cb105e4c8df7533a10a4ecf53cabda13437e28f7b1daea2f465957845f688e7b341355a98b9e57e411a1e2660d84ce06f9d66b596517439af1a63c14c9b4b04659548654fff37cfb46e44e274e9132e8cc3d897e1f42e3906cf212ca3bda8e8c7edfbfdd3c9b5e729e75797b260c9b2001e868ef261a0d916d4657688d119c86ad39c6cd5d3e26af764dea1e83fa03e43fa66a1635f9ce0f1856cf5b496428a848a066e93f3bb84e39a416dcbbb4027e151ce5091c239c9d7d18ffc279035bc06310af95129420b46f95c930272089c854753b6b18e5dfd07793dd2ebe3616e4da1c11fd782e754f7f8a39839d70a8e49b9532ffb5fe23318907265b9910536d0054acd1b43d5764c54e17a698ca9b7dfe4559251f2a87970b37f93e5fe185a3c6e85ff59e3a55004731f6b756949931e6198411cb5567021962a6c770cbbe26b84fb791e97bc1d752818c0a804788446689b7d3896320f16e7a16db0e9538b8bb79ef797632a68434ff720759edab6a2607b7d1c97e364fd09e48a11f93c5898dbb45925ce22af4522bc093a59d560a542f11572ba4d18ad3bbd8db00856ac6d32460c023334d62b0f5a1c7e4eeb35e27a14b9489871d7f1b30f06d35e3ca26889f30a17dd092807e69fc1543170d1eff23b4802face0cb5e52418518fbf01fb77c7ccd5fb8141e01c827ff916f2da362c173b5782570cd3acae4d47d391eeffe1678bcd31fa33421357810aabf47bddec6d9eafb779f704f024bfac2bc7adf38d9beb2798be8fa94032025425e1dc3b7ed73a4b0eddd7d5ab3a06e0174916f61c185718ea9f60ac33edb7379af99b34fc28f99444258e80a6bd2a5c3555c4354c4c635cadc9d41964b7f4386d8a87c26d461a1446051ecdd8c83c17fd858df8d7bb14360216257f1c2f45635dd9acf5fe904aab9908d2c9a8e309a4865e3af5eda84114a9890287f11d3176c337e26f46c92700306c3aa54c3bfdd92637b322de78e883fd809abe494ac1669c103cc0ee18e66bb8b61ffd6c5c28936ef9daa58c5e101be464c57094860d58f2cd02fc61192b2b72dc72c74d1237163ca177653d9aab2f12063aa71419790988fb723fce32f84d06fad204d1107e124068faace8e5bfc7f2c2bff160842632b4c74cf546434d7a8596c609e7131de6b5942e7dfd9daebd3362d5cf794473deeba593cf494c13b6fa1eb7f11e98a6483cd1c9a17ec9433d69bb71e2612126b706ec35a98bdf9e560527398799f89df351c8c7f5476d9ffdb9960991ec443da66090a4ee9019d7c98c7237bcaa89a7511e404431f178aee267b77dfbe2688b0d1d0aa5a3916ae1d747b9a0e9285fcd1bca4fc2990e3d618a2a98b08a9c6db19cb4dcd9139e5b958067627da4a3d35bbba3f4a91775483db58e67fb42b976978168ce9e1d97a2d0cb69fc12002e213615ae9e3b35426d1b5e60480781216a9086027183f27af6e344a1eaf8eeb61bedd7452a64fc33d84ad5562e02b8a49364b0831258ece730e7ba96fe78a51678d5b5f2b6c3c3bc121949fbc777e28c670d34d890cb5a9538f530143f36827ec68b476fd9a57436d41944b12d60cb48a0a3523cb8afb60e1d78fbb661bf620621cd517eb3dfc2457606371595d17aba9b4dc3d42d0345cc81b9aedb916cb4cbf32555f07686c007e831c269ed1e6aa961c0424bba744159eb0cf307f53724b80cc5c063e240f1f0f4c78ea01bd204a01d973ba5511130e02952a88f48668852d984ae2142d4b0ceb39197968ce199d4e936b9954feaa8a8bff3d7bd6031a425c31a1de0a3c48cc6d8b679546b83031e5f98fa4c900e82fe696d4bcb9aee54bd1f44b6bdb694616a627ae0c43ba9413877818ae881eb53141944028c762b6e15cc26d2aa5db7e44af84bcc1f5b6f0c2c23d0c883f4b224dce73e8c256d8ec4f4c47d49d550f508f4416808374fe64b9cf7cf1443e21973a72f221f3f833232dbc7b2e3bb3764979bcee46bbe76531fe62d548219caa9260692f08ccddb9eb88ed782035702aa00e37b3fec10b161e5f93fd110fa8345cf0c1b9e2ce021de3d0350aafd14155bf30a9d2876ae78d89945dec3cbad988cccd08e4bccb6daa36cfd3d10e9036c47599d80260c3f98da52cd9080e43fc53165c9a67c1d0ace498b227c3b55f9da80dc2057a15a8f3b5b130db1d13828864655f7a7b0fe33f554ac63ec7a63490f2a1dc060f498e47b258bc16ebbf89396ca33bc00e3e14342e04d149432257e9299609b52ced26988b8e5e4ac4e8ea1487b4e871bc3b4c9315c9d2e63397e66be29f592f8469ed52defb02f844a80ba58426fffd78509f22f3d9c6689cf143ea7df4d4cf105784e413cd6c5407735f513234cc883897b6a371c6998bce24638dc8e663920dcec5344bd2b1f9b0c5b93225d4039d9ac532b4633dfab858741ea9ff77ca426604f5940ec27dda7a2e7b5c3cb6a108298dfd86edadfba1230427f8d5bd142d7c5606287555d084a00e41606b214da562e029eab4da646f2e6705ac686384dfb68e60b2938f2ede3be86106e1bd9c82d4aa950c75f1320d372341a6878364abe35511a05f9f5c9fb2720b45b400a46130884e14a047865461ddd3a684798e64d977a6d24dbb5364a4dc774693a411f8f2a8c339a2cdea8ffc92f3166d541273d9518204d357afdc75e860f7541285f00441139c481adcf733b07364ebaadd279b84a459c707614e813b8962afbf46791f391ef79b051a2eb132193adf86e441350a8d6da44488c6984663aeb016b4e77ad0159e109b2ef9de5e1ab892a5281a1e1e3a21291d0d77b99ca2304139facc645a0d38b73c8ee908a5d1e1a5b6739f5ee56562b8ec10d0e944a0c28b362643363923b003fe3358a4e58e7c107968f19423eb3009047e61803e0f4a0969353ec274907e9663c4398e1d29b6b612576f0a4f9222960a4f2e49f1fcda63548c5968bec2cbd72f733d9e42a8dfcb4dd8b6d20471dbb9dd109e52a5da36bce113f636ba148b7b0fe3172a046a2f4465b99c1eab9c78eae3a8f7a37f1b577bccce8d83cc80d74f99866782aa7963a9301885398288c5e4f431c8b6bce9e008176adb65afc8c26e9850a470d924a308a974735645d19a85f95fef07ab46a0ffb7f8908c81ada337772abc6e8eb2564e093639416822e49923837391d9f3aedf92a2a06abd313dfaef75aa690d87203516090b13f93e10f61380866c68071426723ebc270588d7294267df054cd269b8fec82411fb6d7f92b5e7f41e5e27a4401406f3c6d6e85e7e03ccc6d59ee80eb1d3bb9b43b818af31143e3e57f979667d671a80ed07c67fd081ab722261fad297878208bf6ed73821b7a4234befa3140108f34b970bef36b62e4c4ef56852329a41c0ca84977ca81aa9ee2eff8b0b4bdce0e89e36b3a8026a2ce0d02ae525a2dae068b1e2a56cd076ac3938d98df03d645d91491d8797390d7b4893a68a637e59967c44430c82068db20cf580f81fc8472aa2671c297f846860895c71fab1b3f5023bd1e21e8670fad753a094cf761668c3f93a7a64f46b0f662ab724154eef49bcca3e250f0708355c2df6e5e26026ef7b8f183432e0d926104241b875a2d69b1ab373b6b4732d1ba218f02568fb92806dd642f427998e0ab1afb6422906ba59782e250200f8017b8b7b766387df2948bc901ff540f0cfdbcffd46e439eb1f1ce0f67966426a7f5be15294c6c3348618bddab841e32eeb2665004908ca5bb38d6a0a977f824bf83b248fcc8d04a", @ANYRESHEX=r0], 0x0)
ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2})
r6 = add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)='[', 0xfeed, 0xffffffffffffffff)
keyctl$revoke(0x3, r6)
ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f00000001c0)=0x2)
ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f0000000200)=0x1)
executing program 4:
syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650caa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94)
r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x2, 0x4, 0x200, 0x0, {0x77359400}, {0x1, 0x2, 0x0, 0x0, 0x0, 0xfe, "05000100"}, 0x0, 0x2, {}, 0x20800})
write$binfmt_misc(r1, &(0x7f0000000040), 0xe09)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x80000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x31]}})
executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="120000000100000004"], 0x50)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000240), 0x3)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "7c98b307afa2738e", "9797fed914ba965b281cbe8c9b39e729", "049cee36", "90993a510db0b184"}, 0x28)
writev(r0, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x100000000000027b)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff3, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0xe38, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x40010)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 7, 7, 29, 7, 6, 7, 30, 7, 6, 6]
detailed listing:
executing program 0:
socket$inet_tcp(0x2, 0x1, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x10)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xd70, 0x1f280, 0x0, 0x1c7})
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00')
io_uring_enter(r0, 0x100, 0x11, 0x1f, 0x0, 0x0)
executing program 0:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
writev(r0, &(0x7f0000000240)=[{&(0x7f0000000280)="0232e6fe", 0x4}], 0x1)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0)
ioctl$FS_IOC_READ_VERITY_METADATA(0xffffffffffffffff, 0xc0286687, 0x0)
r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r1)
ptrace$poke(0x5, r1, &(0x7f00000001c0), 0x7)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4)
connect$inet(r0, &(0x7f00000006c0)={0x2, 0x0, @dev}, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)={0x14, 0x10, 0x21, 0xfffffffd, 0x0, {0x3}}, 0x14}}, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000180)=0x2, 0x4)
sendmmsg$inet(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000005c0)="b8", 0x1}], 0x1}, 0xa6}], 0x1, 0x4008440)
executing program 2:
syz_open_dev$video4linux(&(0x7f0000000000), 0xb7c, 0x100)
r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x9d49, 0x400, 0x2, 0x51}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0)
r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x240, 0x0)
ioctl$XFS_IOC_COMMIT_RANGE(0xffffffffffffffff, 0x40585883, &(0x7f00000001c0)={r4, 0x0, 0xfffffffffffff206, 0x3, 0x2a98, 0x2, [0x401, 0x6, 0x8, 0x0, 0x8, 0x1000]})
set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x3)
r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r5, 0x0, 0x0)
syz_usb_control_io$hid(r5, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff)
close(r7)
execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r10, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0xeeee8000, 0xf000, 0x7, 0x7, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x1, 0xddccb000, 0xd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1}, {0x118004, 0xdddd8000, 0x18, 0xe, 0x0, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x6}, {0x10b002, 0x2000, 0xc, 0xfd, 0x80, 0x0, 0x1}, {0x1000, 0x0, 0xd, 0x8, 0x70, 0x80, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0x100026fff, 0xeeef0000, 0x8, 0x4, 0x0, 0x8, 0x0, 0x0, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0x10000, 0xf, 0x0, 0x5, 0x0, 0x0, 0x81, 0x0, 0x4}, {0xd000, 0x41000, 0x3, 0x82, 0xfc, 0x10, 0x4, 0xe}, {0x0, 0x800}, {0x1, 0xfffe}, 0x40000010, 0x0, 0x0, 0x10, 0x1000000000000001, 0x0, 0x900, [0x0, 0x0, 0x2, 0x5]})
ioctl$KVM_RUN(r10, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r10, 0x4140aecd, &(0x7f0000000100))
r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003c00), r6)
sendmsg$ETHTOOL_MSG_EEE_SET(r6, &(0x7f00000040c0)={0x0, 0x0, &(0x7f0000004080)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010026bd7000ffdbdf2518000000180001801400020067656e65766530000000000000000000d9de2b7491b4eeb7099957387d802f278da6f0073b8270e2dbd992e5d083c29c567d8a86ab37553ac0549039195ee96d7a7fcfb7c586260aba7a4d82fe0f1565dc125505ad1f06d7efe6eae2b510296d2f01ea0551713b016a537fa6674ffb188e9050ddd52316ccfed7ec064d47f89f63d0f36c135a2d29ac2265769683ddc249b58e9d28e90a2303da229941820c74413370379b99156f5d30535b21a1bd2265a3876b9281c0e68a1596a36c8be01b262ca53d7aeff5dd3e5f5fa5ca29c2aed958fba697ba6ae227ced4571e34a3fb6078ceb1ddb62a412c5e981aa9fcec4b8c2ae09ba2be4876d569ca4222d334e45c1a23c0b34bbcc8a349bd0000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x40008000)
r12 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0)
ioctl$HIDIOCSREPORT(r12, 0x81044804, 0x0)
set_mempolicy(0x4000, &(0x7f0000000080)=0xc00, 0xffffffffffffb176)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x21800, 0x0)
accept$alg(0xffffffffffffffff, 0x0, 0x0)
r13 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
executing program 0:
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e20, 0x1000, @local, 0x7ff}}, 0x9, 0x3, 0x9, 0x7fffffff, 0x8}, &(0x7f0000000280)=0x98)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2})
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x40000070, 0x0, 0x400006}]})
executing program 0:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0)
socket$kcm(0x10, 0x2, 0x0)
ioctl$DVB_DEMUX_DMX_GET_STC(0xffffffffffffffff, 0xc0106f32, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000040)=ANY=[@ANYBLOB="200f11000000", @ANYRES16=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0)
executing program 1:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff})
connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4)
socket$can_raw(0x1d, 0x3, 0x1)
sendmmsg$inet(r3, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c)
connect$inet6(r4, &(0x7f0000000000)={0x2, 0x4e23, 0x0, @mcast1, 0x4}, 0x1c)
r5 = socket$netlink(0x10, 0x3, 0x8000000004)
connect$inet6(r4, &(0x7f0000000800)={0xa, 0x4e24, 0xc0, @ipv4={'\x00', '\xff\xff', @loopback}, 0xc58e}, 0x1c)
writev(r5, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac710aa7d0000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1)
syz_open_dev$sg(0x0, 0x0, 0x40100)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x4)
preadv(r5, &(0x7f00000022c0)=[{&(0x7f00000006c0)=""/73, 0x49}, {&(0x7f0000000740)=""/155, 0x9b}, {&(0x7f0000000840)=""/239, 0xef}, {&(0x7f0000000940)=""/247, 0xf7}, {&(0x7f0000000a40)=""/166, 0xa6}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000001240)=""/4096, 0x1000}], 0x7, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'bridge_slave_1\x00', @link_local})
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={0xffffffffffffffff, 0x0, &(0x7f0000000640)=""/13, 0x2}, 0x20)
r7 = socket$netlink(0x10, 0x3, 0x0)
writev(r7, &(0x7f0000000e00)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}, {&(0x7f0000000c00)="f089544272076c4d41fd398602b89b3fa3a9c58c88fe7b2196418b996d0900ab2acfaec9736958e9251d2dc35428a4d9f2e99383bbd12a723adde1215cba8da2fdc128a0c03d99353c90f9872df89d9e17fe616960fa65b29a328c5a3ad12eef1b1c40dd6095277b3a3af49cb421ea7b54e04a5a4b3e69355c5990305623ead4c316857b5b0c02a2bc26238cb7570e5771d92572ae7a25d7ef3016422e47328807aa0d756af338ede7940af5c81003a1fd00a3f5", 0xb4}, {&(0x7f0000000d00)="8d2aadf53c167444d7ecf2ff4aebc7af0637ef9c57778a567de1ae283b63a457869d734c1a43768ad2ca13eebce8a40a3c3fc64f933b80aa681e48449e7cdb3dc8577006b9532ea431e2bc35239518388132f7b03ba7530aca3d55738e10823d67cfc4f779f3334bc2a00212772e14650115b553ec39d5a1d117343fed6e80a0bc8883e526252e9278d4d8a8bc56e59fd506dafe2b695add69459918b0acd7657b53a6bd1da27dd5244e2acbd72f315ffefc3212c7d5ee2ddeadef0c1027d554834014d0641099407b62ed00fe72eacde224fce85be583b7c35e2747763b8f5926", 0xe1}], 0x3)
sendto$inet(r3, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
madvise(&(0x7f00000ee000/0x2000)=nil, 0x2000, 0x8)
readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/13, 0xd}, {&(0x7f0000000180)=""/15, 0x13}], 0x1d)
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <10>
bisect: split chunk #0 of len 10 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 7, 30, 7, 6, 6]
detailed listing:
executing program 0:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0)
socket$kcm(0x10, 0x2, 0x0)
ioctl$DVB_DEMUX_DMX_GET_STC(0xffffffffffffffff, 0xc0106f32, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000040)=ANY=[@ANYBLOB="200f11000000", @ANYRES16=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000010b00033264756d6d7930000008001f0004000000180012000a00010064756d6d79"], 0x4c}], 0x1, 0x0, 0x0, 0x4040001}, 0x0)
executing program 1:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff})
connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4)
socket$can_raw(0x1d, 0x3, 0x1)
sendmmsg$inet(r3, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c)
connect$inet6(r4, &(0x7f0000000000)={0x2, 0x4e23, 0x0, @mcast1, 0x4}, 0x1c)
r5 = socket$netlink(0x10, 0x3, 0x8000000004)
connect$inet6(r4, &(0x7f0000000800)={0xa, 0x4e24, 0xc0, @ipv4={'\x00', '\xff\xff', @loopback}, 0xc58e}, 0x1c)
writev(r5, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac710aa7d0000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1)
syz_open_dev$sg(0x0, 0x0, 0x40100)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x4)
preadv(r5, &(0x7f00000022c0)=[{&(0x7f00000006c0)=""/73, 0x49}, {&(0x7f0000000740)=""/155, 0x9b}, {&(0x7f0000000840)=""/239, 0xef}, {&(0x7f0000000940)=""/247, 0xf7}, {&(0x7f0000000a40)=""/166, 0xa6}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000001240)=""/4096, 0x1000}], 0x7, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'bridge_slave_1\x00', @link_local})
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={0xffffffffffffffff, 0x0, &(0x7f0000000640)=""/13, 0x2}, 0x20)
r7 = socket$netlink(0x10, 0x3, 0x0)
writev(r7, &(0x7f0000000e00)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}, {&(0x7f0000000c00)="f089544272076c4d41fd398602b89b3fa3a9c58c88fe7b2196418b996d0900ab2acfaec9736958e9251d2dc35428a4d9f2e99383bbd12a723adde1215cba8da2fdc128a0c03d99353c90f9872df89d9e17fe616960fa65b29a328c5a3ad12eef1b1c40dd6095277b3a3af49cb421ea7b54e04a5a4b3e69355c5990305623ead4c316857b5b0c02a2bc26238cb7570e5771d92572ae7a25d7ef3016422e47328807aa0d756af338ede7940af5c81003a1fd00a3f5", 0xb4}, {&(0x7f0000000d00)="8d2aadf53c167444d7ecf2ff4aebc7af0637ef9c57778a567de1ae283b63a457869d734c1a43768ad2ca13eebce8a40a3c3fc64f933b80aa681e48449e7cdb3dc8577006b9532ea431e2bc35239518388132f7b03ba7530aca3d55738e10823d67cfc4f779f3334bc2a00212772e14650115b553ec39d5a1d117343fed6e80a0bc8883e526252e9278d4d8a8bc56e59fd506dafe2b695add69459918b0acd7657b53a6bd1da27dd5244e2acbd72f315ffefc3212c7d5ee2ddeadef0c1027d554834014d0641099407b62ed00fe72eacde224fce85be583b7c35e2747763b8f5926", 0xe1}], 0x3)
sendto$inet(r3, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
madvise(&(0x7f00000ee000/0x2000)=nil, 0x2000, 0x8)
readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/13, 0xd}, {&(0x7f0000000180)=""/15, 0x13}], 0x1d)
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 6, 6]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x7c8})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1})
madvise(&(0x7f00000ee000/0x2000)=nil, 0x2000, 0x8)
readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/13, 0xd}, {&(0x7f0000000180)=""/15, 0x13}], 0x1d)
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6]
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program did not crash
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6]
detailed listing:
executing program 0:
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')
preadv(r3, &(0x7f0000000400)=[{&(0x7f0000000040)=""/196, 0xc4}], 0x1, 0xf, 0xfffffbff)

program did not crash
minimized 6 calls -> 4 calls
minimizing program #1 before concatenation
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)
syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00')

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400)=<r1=>0x0, &(0x7f0000011000)=<r2=>0x0, &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)
syz_io_uring_complete(r1, r2)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)
ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, 0x0)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
r0 = syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000))
io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20)

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 1]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:
syz_io_uring_setup(0x2d64, &(0x7f0000000100)={0x0, 0xa0f3, 0x2, 0x0, 0x42}, &(0x7f0000000400), &(0x7f0000011000), &(0x7f0000000000))

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0]
detailed listing:
executing program 1:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
executing program 0:

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
minimized 6 calls -> 0 calls
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
bisect: concatenation succeeded
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000600)={0x40}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
extracting C reproducer
testing compiled C program (duration=1m25.929149642s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
simplifying C reproducer
testing compiled C program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing compiled C program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
program crashed: BUG: sleeping function called from invalid context in mmc_free_host
testing program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
validation run: crashed=true
testing program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
validation run: crashed=true
testing program (duration=1m25.929149642s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program crashed: BUG: sleeping function called from invalid context in mmc_free_host
validation run: crashed=true
reproducing took 1h22m57.556915636s
repro crashed as (corrupted=false):
BUG: sleeping function called from invalid context at kernel/workqueue.c:4561
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
preempt_count: 101, expected: 0
RCU nest depth: 0, expected: 0
locks held by swapper/0/0: 1, last CPU#0:
 #0: ffffc90000007cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
Preemption disabled at:
[<ffffffff8be81a1d>] schedule_preempt_disabled+0x1d/0x30 kernel/sched/core.c:7434
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264
 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561
 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: bb 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 a1 22 00 fb f4 <e9> 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8ea07ca0 EFLAGS: 00000246
RAX: 00000000000b7fdb RBX: ffffffff819bcc20 RCX: 8000000000000001
RDX: 0000000000000001 RSI: ffffffff8e416437 RDI: ffffffff8c6dad80
RBP: ffffffff8ea07d78 R08: ffff8880b8633a1b R09: 1ffff110170c6743
R10: dffffc0000000000 R11: ffffed10170c6744 R12: 0000000000000000
R13: 1ffffffff1d51e00 R14: 1ffffffff1d40f9c R15: dffffc0000000000
 arch_safe_halt arch/x86/kernel/process.c:767 [inline]
 default_idle+0x9/0x20 arch/x86/kernel/process.c:768
 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x2e0/0x540 kernel/sched/idle.c:355
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
 rest_init+0x378/0x3a0 init/main.c:732
 start_kernel+0x392/0x3e0 init/main.c:1190
 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291
 common_startup_64+0x13e/0x157
 </TASK>
ODEBUG: object ffffc90000007a80 is NOT on stack ffffffff8ea00000, but annotated.
------------[ cut here ]------------
1
WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#0: swapper/0/0
WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#0: swapper/0/0
WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#0: swapper/0/0
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline]
RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline]
RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798
Code: cc cc cc 41 ff c7 44 89 3d 89 3e e8 15 48 c7 c1 80 b6 6d 8c 48 c7 c7 e0 b6 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 cd a0 3c fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 a1 a9 6d 0a 3b 05 9f
RSP: 0018:ffffc900000079b8 EFLAGS: 00010046
RAX: 0000000000000050 RBX: ffffc90000007a80 RCX: 6789184714e8c100
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffffffff8ea8f020 R08: 0000000000000100 R09: 1ffff110170c48e2
R10: dffffc0000000000 R11: ffffed10170c48e3 R12: ffff888022b17a60
R13: ffff8880774c4f50 R14: dffffc0000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888124cc7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562156475040 CR3: 0000000078738000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475
 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
 wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237
 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x222/0x550 lib/kobject.c:737
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: bb 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 a1 22 00 fb f4 <e9> 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8ea07ca0 EFLAGS: 00000246
RAX: 00000000000b7fdb RBX: ffffffff819bcc20 RCX: 8000000000000001
RDX: 0000000000000001 RSI: ffffffff8e416437 RDI: ffffffff8c6dad80
RBP: ffffffff8ea07d78 R08: ffff8880b8633a1b R09: 1ffff110170c6743
R10: dffffc0000000000 R11: ffffed10170c6744 R12: 0000000000000000
R13: 1ffffffff1d51e00 R14: 1ffffffff1d40f9c R15: dffffc0000000000
 arch_safe_halt arch/x86/kernel/process.c:767 [inline]
 default_idle+0x9/0x20 arch/x86/kernel/process.c:768
 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x2e0/0x540 kernel/sched/idle.c:355
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
 rest_init+0x378/0x3a0 init/main.c:732
 start_kernel+0x392/0x3e0 init/main.c:1190
 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291
 common_startup_64+0x13e/0x157
 </TASK>
----------------
Code disassembly (best guess):
   0:	bb 87 02 c3 cc       	mov    $0xccc30287,%ebx
   5:	cc                   	int3
   6:	cc                   	int3
   7:	cc                   	int3
   8:	cc                   	int3
   9:	cc                   	int3
   a:	cc                   	int3
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	f3 0f 1e fa          	endbr64
  1f:	66 90                	xchg   %ax,%ax
  21:	0f 00 2d d3 a1 22 00 	verw   0x22a1d3(%rip)        # 0x22a1fb
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	e9 8c 08 03 00       	jmp    0x308bb <-- trapping instruction
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	cc                   	int3
  38:	cc                   	int3
  39:	cc                   	int3
  3a:	cc                   	int3
  3b:	90                   	nop
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop

final repro crashed as (corrupted=false):
BUG: sleeping function called from invalid context at kernel/workqueue.c:4561
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
preempt_count: 101, expected: 0
RCU nest depth: 0, expected: 0
locks held by swapper/0/0: 1, last CPU#0:
 #0: ffffc90000007cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 kernel/time/timer.c:1745
Preemption disabled at:
[<ffffffff8be81a1d>] schedule_preempt_disabled+0x1d/0x30 kernel/sched/core.c:7434
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 __might_resched+0x36a/0x4c0 kernel/sched/core.c:9264
 __cancel_work_sync+0x6d/0x110 kernel/workqueue.c:4561
 mmc_free_host+0x19/0x40 drivers/mmc/core/host.c:700
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: bb 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 a1 22 00 fb f4 <e9> 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8ea07ca0 EFLAGS: 00000246
RAX: 00000000000b7fdb RBX: ffffffff819bcc20 RCX: 8000000000000001
RDX: 0000000000000001 RSI: ffffffff8e416437 RDI: ffffffff8c6dad80
RBP: ffffffff8ea07d78 R08: ffff8880b8633a1b R09: 1ffff110170c6743
R10: dffffc0000000000 R11: ffffed10170c6744 R12: 0000000000000000
R13: 1ffffffff1d51e00 R14: 1ffffffff1d40f9c R15: dffffc0000000000
 arch_safe_halt arch/x86/kernel/process.c:767 [inline]
 default_idle+0x9/0x20 arch/x86/kernel/process.c:768
 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x2e0/0x540 kernel/sched/idle.c:355
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
 rest_init+0x378/0x3a0 init/main.c:732
 start_kernel+0x392/0x3e0 init/main.c:1190
 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291
 common_startup_64+0x13e/0x157
 </TASK>
ODEBUG: object ffffc90000007a80 is NOT on stack ffffffff8ea00000, but annotated.
------------[ cut here ]------------
1
WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack lib/debugobjects.c:672 [inline], CPU#0: swapper/0/0
WARNING: lib/debugobjects.c:672 at lookup_object_or_alloc lib/debugobjects.c:705 [inline], CPU#0: swapper/0/0
WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798, CPU#0: swapper/0/0
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:debug_object_is_on_stack lib/debugobjects.c:672 [inline]
RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:705 [inline]
RIP: 0010:__debug_object_init+0x2c4/0x3c0 lib/debugobjects.c:798
Code: cc cc cc 41 ff c7 44 89 3d 89 3e e8 15 48 c7 c1 80 b6 6d 8c 48 c7 c7 e0 b6 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 cd a0 3c fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 a1 a9 6d 0a 3b 05 9f
RSP: 0018:ffffc900000079b8 EFLAGS: 00010046
RAX: 0000000000000050 RBX: ffffc90000007a80 RCX: 6789184714e8c100
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffffffff8ea8f020 R08: 0000000000000100 R09: 1ffff110170c48e2
R10: dffffc0000000000 R11: ffffed10170c48e3 R12: ffff888022b17a60
R13: ffff8880774c4f50 R14: dffffc0000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888124cc7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562156475040 CR3: 0000000078738000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __synchronize_srcu+0x1d5/0x2f0 kernel/rcu/srcutree.c:1475
 wakeup_source_remove drivers/base/power/wakeup.c:201 [inline]
 wakeup_source_unregister+0x129/0x3f0 drivers/base/power/wakeup.c:237
 mmc_host_classdev_release+0x47/0x100 drivers/mmc/core/host.c:69
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x222/0x550 lib/kobject.c:737
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: bb 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 a1 22 00 fb f4 <e9> 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8ea07ca0 EFLAGS: 00000246
RAX: 00000000000b7fdb RBX: ffffffff819bcc20 RCX: 8000000000000001
RDX: 0000000000000001 RSI: ffffffff8e416437 RDI: ffffffff8c6dad80
RBP: ffffffff8ea07d78 R08: ffff8880b8633a1b R09: 1ffff110170c6743
R10: dffffc0000000000 R11: ffffed10170c6744 R12: 0000000000000000
R13: 1ffffffff1d51e00 R14: 1ffffffff1d40f9c R15: dffffc0000000000
 arch_safe_halt arch/x86/kernel/process.c:767 [inline]
 default_idle+0x9/0x20 arch/x86/kernel/process.c:768
 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:199 [inline]
 do_idle+0x2e0/0x540 kernel/sched/idle.c:355
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
 rest_init+0x378/0x3a0 init/main.c:732
 start_kernel+0x392/0x3e0 init/main.c:1190
 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
 x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291
 common_startup_64+0x13e/0x157
 </TASK>
----------------
Code disassembly (best guess):
   0:	bb 87 02 c3 cc       	mov    $0xccc30287,%ebx
   5:	cc                   	int3
   6:	cc                   	int3
   7:	cc                   	int3
   8:	cc                   	int3
   9:	cc                   	int3
   a:	cc                   	int3
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	f3 0f 1e fa          	endbr64
  1f:	66 90                	xchg   %ax,%ax
  21:	0f 00 2d d3 a1 22 00 	verw   0x22a1d3(%rip)        # 0x22a1fb
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	e9 8c 08 03 00       	jmp    0x308bb <-- trapping instruction
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	cc                   	int3
  38:	cc                   	int3
  39:	cc                   	int3
  3a:	cc                   	int3
  3b:	90                   	nop
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	90                   	nop