Extracting prog: 14m11.773691564s Minimizing prog: 52m44.565652297s Simplifying prog options: 7m20.006347109s Extracting C: 3m30.633787981s Simplifying C: 0s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route_sched-sendmsg$nl_route_sched-openat$kvm-syz_open_procfs-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$x86-syz_kvm_add_vcpu$x86-socket$inet6-setsockopt$inet6_int-sendto$inet6-sendto$inet6-ioctl$KVM_SET_CPUID2-ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID-syz_open_dev$amidi-ioctl$SNDRV_RAWMIDI_IOCTL_INFO-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$x86-syz_kvm_add_vcpu$x86-ioctl$KVM_RUN-syz_usb_control_io$printer-socket$netlink-sendmsg$nl_generic-futex_waitv-syz_usb_control_io-syz_usb_control_io$rtl8150 detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'veth1_to_hsr\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x4a88, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x10, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x4080) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x80402, 0x0) syz_open_procfs(0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$x86(r5, &(0x7f0000000080)={0x0, 0x0}) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r7, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r7, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback={0xff00000000000000}}, 0x1c) sendto$inet6(r7, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000140)={0x2, 0x0, [{0x40000001, 0x7fff, 0x4, 0x31237648, 0x6, 0x2, 0x80}, {0x40000003, 0x80000000, 0x1, 0xffff, 0xffffffff, 0x5b}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r6, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) r8 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x20000) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r8, 0x40045731, &(0x7f0000000000)) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r10, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r5, &(0x7f0000000080)={0x0, &(0x7f0000000580)=[@rdmsr={0x66, 0x18, {0x40000001}}], 0x18}) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) r11 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000380)={0x18, 0x14, 0x609, 0x0, 0x0, {0x1e}, [@generic="c1"]}, 0x18}}, 0xc044) futex_waitv(&(0x7f0000001640)=[{0x7de, &(0x7f0000000240)=0x7fffffffffffffff, 0x82}, {0x5, &(0x7f0000000280)=0x3, 0x2}, {0x8000000000000001, &(0x7f0000000640), 0x2}, {0x401, &(0x7f0000000680)=0x9, 0x80}, {0x5, &(0x7f00000006c0)=0xfffffffffffffffd, 0x82}, {0xfffffffffffffff9, &(0x7f0000000700)=0x85, 0x82}, {0x5, &(0x7f0000000740)=0x1, 0x2}, {0x7be, &(0x7f0000000780)=0xac7b, 0x82}, {0x8001, &(0x7f00000007c0)=0x8, 0x2}, {0x100000001, &(0x7f0000000800)=0x7, 0xd45305bf8da1abaa}, {0x4, &(0x7f0000000840)=0x1, 0x80}, {0x1, &(0x7f0000000880)=0xa, 0x82}, {0x7, &(0x7f00000008c0), 0x2}, {0x10000, &(0x7f0000000900)=0x3, 0x2}, {0xffffffffffffff8f, &(0x7f0000000940), 0x82}, {0x58, &(0x7f0000000980)=0x46ac, 0x2}, {0x7ff, &(0x7f0000000a80)=0x3, 0x2}, {0x2, &(0x7f0000000ac0)=0x8, 0x2}, {0x1, &(0x7f0000000b00), 0x82}, {0xffff, &(0x7f0000000b40)=0x7, 0x82}, {0x40, &(0x7f0000000b80)=0x7fffffffffffffff, 0x82}, {0xfffffffffffffffa, &(0x7f0000000bc0)=0x99, 0x2}, {0x2, &(0x7f0000000c00)=0x3, 0x82}, {0x2, &(0x7f0000000c40)=0xffffffffffffffff, 0x2}, {0x43, &(0x7f0000000c80)=0x4, 0x3}, {0x8fea, &(0x7f0000000cc0)=0x2, 0x82}, {0xfffffffffffffffd, &(0x7f0000000d00)=0xf, 0x82}, {0x9, &(0x7f0000000d40)=0x8, 0x82}, {0xa, &(0x7f0000000d80)=0x5, 0x2}, {0x401, &(0x7f0000000dc0)=0x2, 0x2}, {0x7, &(0x7f0000000e00)=0x200, 0x2}, {0x1, &(0x7f0000000e40)=0x7fffffffffffffff, 0x82}, {0x7, &(0x7f0000000e80)=0x5, 0x2}, {0x48b, &(0x7f0000000ec0)=0x7667, 0x82}, {0x0, &(0x7f0000000f00)=0x7, 0x82}, {0x0, &(0x7f0000000f40)=0x4, 0x82}, {0x8, &(0x7f0000000f80)=0x2, 0x82}, {0xc3c, &(0x7f0000000fc0)=0x6}, {0x4, &(0x7f0000001000), 0x82}, {0x6655, &(0x7f0000001040)=0x1, 0x2}, {0x40000, &(0x7f0000001080)=0x538b, 0x2}, {0x4, &(0x7f00000010c0)=0xd, 0x6}, {0x9, &(0x7f0000001100)=0x9, 0x82}, {0x0, &(0x7f0000001140)=0xfffffffffffffffb, 0x2}, {0x1, &(0x7f0000001180)=0x3, 0x82}, {0x1, &(0x7f00000011c0)=0xff, 0x2}, {0x8000000000000000, &(0x7f0000001200)=0x7, 0x82}, {0x101, &(0x7f0000001240)=0x9, 0x2}, {0x5, &(0x7f0000001280)=0x5, 0x82}, {0x3, &(0x7f0000001300)=0x8, 0x2}, {0x7, &(0x7f0000001340)=0x4, 0x82}, {0x1d3, &(0x7f0000001380)=0x1, 0x2}, {0x2, &(0x7f00000013c0)=0x6, 0x82}, {0x54, &(0x7f0000001400)=0x1c, 0x82}, {0x0, &(0x7f0000001440)=0x2, 0x2}, {0x0, &(0x7f0000001480)=0x8, 0x2}, {0x7, &(0x7f00000014c0)=0x13, 0x82}, {0x10001, &(0x7f0000001500)=0x2, 0x2}, {0x2, &(0x7f0000001540)=0xfffffffffffffffd, 0x2}, {0x9, &(0x7f0000001580)=0xa, 0x2}, {0x9, &(0x7f00000015c0)=0x7fff, 0x82}, {0x7fff, &(0x7f0000001600)=0x1, 0x82}], 0x3e, 0x0, &(0x7f0000001c40), 0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000000440)={0x40, 0x31}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f00000002c0)={0x40, 0x15}, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket$rds-io_submit-epoll_create1-bpf$PROG_LOAD-prlimit64-sched_setscheduler-removexattr-sched_setaffinity-prctl$PR_SCHED_CORE-syz_open_dev$MSR-fcntl$setlease-fcntl$getflags-read$msr-socket$inet6_tcp-setsockopt$inet6_tcp_int-socket$inet6_mptcp-connect$inet6-socket$netlink-writev-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$IOC_WATCH_QUEUE_SET_FILTER-mount detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) epoll_create1(0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) fcntl$getflags(0xffffffffffffffff, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r2]) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-ioctl$MEDIA_IOC_REQUEST_ALLOC-syz_ublk_setup_io_uring-bpf$BPF_BTF_LOAD-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-syz_open_dev$radio-socket-syz_open_dev$vim2m-pselect6-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-ioctl$VIDIOC_G_EXT_CTRLS-socket$nl_generic-ioctl$sock_SIOCGIFINDEX-bpf$PROG_LOAD_XDP-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL detailed listing: executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, 0x0) syz_ublk_setup_io_uring(0x22cf, &(0x7f0000000240)={0x0, 0xd58c, 0x10, 0x3, 0x108}, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$radio(0x0, 0x3, 0x2) socket(0x2b, 0x1, 0x1) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x10000, 0xffffffffffffffff, 0x0, 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x5, &(0x7f0000000a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@jmp={0x6, 0x0, 0xb, 0x0, 0x0, 0x1, 0x8}, @exit]}, &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-mkdirat-mount-write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001200)='stop', 0x4) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-prctl$PR_SCHED_CORE-prlimit64-bind$802154_raw-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-socket$nl_generic-sendmsg$nl_generic-fsopen-openat$kvm-ioctl$KVM_CREATE_VM-dup-ioctl$KVM_CHECK_EXTENSION_VM-add_key-keyctl$KEYCTL_RESTRICT_KEYRING-sendmmsg-setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX-socket-brk-getsockopt$bt_hci detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="3800000020000100ecc2000000000000020020000000000100000000140003006c6f00000000000000000000000000000800"], 0x38}, 0x1, 0x0, 0x0, 0x4044800}, 0x20000076) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) bind$802154_raw(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102384, 0x18ff0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f000000b7c0)={0x18, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}]}, 0x18}, 0x1, 0x0, 0x0, 0x200048d5}, 0x4008094) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x21) r5 = dup(r4) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x81) r6 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x3265418f5ec1340, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) r7 = socket(0x2, 0x80805, 0x0) brk(0x200000ffc000) getsockopt$bt_hci(r7, 0x84, 0x0, &(0x7f0000000000)=""/4087, &(0x7f0000001000)=0xff7) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 3, 23, 28, 28, 28, 28, 23, 28, 23, 30, 23, 22, 28, 14, 24, 12, 20, 29, 13, 27, 26, 7, 4, 5, 28, 21, 12, 24, 29] detailed listing: executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r2 = accept(r0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="120000000200000004000000a4"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, 0x0, &(0x7f00000002c0)=@tcp=r2}, 0x20) recvmsg$can_bcm(r2, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x10060) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000004480)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/157, 0x9d}, {&(0x7f0000000040)=""/185, 0xb9}, {&(0x7f0000000700)=""/79, 0x4f}, {&(0x7f00000027c0)=""/4133, 0x1025}], 0x4}, 0xd}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x402}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000100, 0x0) executing program 3: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003d37d840890457e00000000000010902240003000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000980)={0x1c, &(0x7f00000000c0)=ANY=[@ANYBLOB="9a6e45c6be66c17a53742827ad8c11620ab4db87db285ce4741940aa4fbdac48aa426839a223d625597af8928a1dce672add2d6c784879ee4947587742cdb660876c08968742291e65"], 0x0, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) r2 = eventfd2(0x51cc, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000e72000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000b30000/0x400000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r2}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x24, &(0x7f0000000040)={0x0, 0x73e9, 0x1f410, 0x0, 0x19c}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r5, &(0x7f0000000140)="012031303030303030303030203020302030206b726235200020757365720a", 0x23) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r2 = open(&(0x7f00009e1000)='./file0\x00', 0x448101, 0x0) fcntl$setlease(r2, 0x400, 0x1) fcntl$getflags(r2, 0x401) read$msr(r1, &(0x7f0000019300)=""/102392, 0x18ff8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, 0x0, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r5, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r6, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r4]) ioctl$RTC_ALM_READ(r7, 0x40187013, &(0x7f0000000080)) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000c00)={@cgroup=r3, 0xf, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write(r3, &(0x7f0000000140)='1', 0x1) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x5453, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='10', 0x2) close(r3) socket$packet(0x11, 0x3, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x528, &(0x7f0000000300)={0x0, 0x3cb1, 0x10, 0x0, 0x20002f7, 0x0, r3}) r6 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) close(r6) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x23010, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2000031, 0x0) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000c00)={@cgroup=r3, 0xf, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write(r3, &(0x7f0000000140)='1', 0x1) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x5453, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='10', 0x2) close(r3) socket$packet(0x11, 0x3, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x528, &(0x7f0000000300)={0x0, 0x3cb1, 0x10, 0x0, 0x20002f7, 0x0, r3}) r6 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) close(r6) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x23010, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2000031, 0x0) executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000c00)={@cgroup=r3, 0xf, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write(r3, &(0x7f0000000140)='1', 0x1) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x5453, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='10', 0x2) close(r3) socket$packet(0x11, 0x3, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x528, &(0x7f0000000300)={0x0, 0x3cb1, 0x10, 0x0, 0x20002f7, 0x0, r3}) r6 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) close(r6) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x23010, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2000031, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003d37d840890457e00000000000010902240003000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000980)={0x1c, &(0x7f00000000c0)=ANY=[@ANYBLOB="9a6e45c6be66c17a53742827ad8c11620ab4db87db285ce4741940aa4fbdac48aa426839a223d625597af8928a1dce672add2d6c784879ee4947587742cdb660876c08968742291e65195d25a2db9e1bb96a6d5f245c24df709e44d796b16fd37591127d97ac1121a45786f66cd7"], 0x0, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) r2 = eventfd2(0x51cc, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000e72000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000b30000/0x400000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r2}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x24, &(0x7f0000000040)={0x0, 0x73e9, 0x1f410, 0x0, 0x19c}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r5, &(0x7f0000000140)="012031303030303030303030203020302030206b726235200020757365720a", 0x23) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8090}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a50000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000240004802000018007000100637400001400028008000140000000130800024000000010140000001100010000000000000000000000000a6d34ca9009e1cdb38e04ccfdd773c710158a2088cfc65bb9d7912fc4c85cd92fc170295e2a018664d9476db54fc40ac5864fd4000042a25313"], 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x85, &(0x7f0000000000)={r5, @in={{0x2, 0x0, @empty}}, 0x0, 0x7ffe}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000340)={r5, @in={{0x2, 0x4e21, @rand_addr=0x64010101}}, 0x800000f, 0x8003, 0x20000, 0x0, 0xcd, 0x0, 0x4}, 0x9c) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) r6 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r6, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket(0x2, 0x1, 0x6) bind(r7, &(0x7f00000000c0)=@in={0x2, 0x3039, @loopback}, 0x10) listen(r7, 0x1) r8 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) accept(r7, 0x0, 0x0) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="3800000020000100ecc2000000000000020020000000000100000000140003006c6f00000000000000000000000000000800"], 0x38}, 0x1, 0x0, 0x0, 0x4044800}, 0x20000076) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) bind$802154_raw(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102384, 0x18ff0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f000000b7c0)={0x18, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}]}, 0x18}, 0x1, 0x0, 0x0, 0x200048d5}, 0x4008094) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x21) r5 = dup(r4) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x81) r6 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x3265418f5ec1340, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) r7 = socket(0x2, 0x80805, 0x0) brk(0x200000ffc000) getsockopt$bt_hci(r7, 0x84, 0x0, &(0x7f0000000000)=""/4087, &(0x7f0000001000)=0xff7) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x0, 0x0) epoll_create1(0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r3 = open(&(0x7f00009e1000)='./file0\x00', 0x448101, 0x0) fcntl$setlease(r3, 0x400, 0x1) fcntl$getflags(r3, 0x401) read$msr(r2, &(0x7f0000019300)=""/102392, 0x18ff8) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, 0x0, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r7, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r5]) ioctl$RTC_ALM_READ(r8, 0x40187013, &(0x7f0000000080)) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10, 0x0}, 0x0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="3800000020000100ecc2000000000000020020000000000100000000140003006c6f00000000000000000000000000000800"], 0x38}, 0x1, 0x0, 0x0, 0x4044800}, 0x20000076) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) bind$802154_raw(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102384, 0x18ff0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f000000b7c0)={0x18, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}]}, 0x18}, 0x1, 0x0, 0x0, 0x200048d5}, 0x4008094) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x21) r5 = dup(r4) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x81) r6 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x3265418f5ec1340, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) r7 = socket(0x2, 0x80805, 0x0) brk(0x200000ffc000) getsockopt$bt_hci(r7, 0x84, 0x0, &(0x7f0000000000)=""/4087, &(0x7f0000001000)=0xff7) executing program 1: syz_usb_connect$uac3(0x0, 0x9f, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000000040ba0d001040000102030109028d000301635006080b00ff010130020904000000"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="ef00000000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0105500, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x2) socket(0x2, 0x800, 0x0) sendmsg(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)="aa44b6f71da8d25c6c72f71b2f0d3aa48fc963b24588c3b60ea4b2d46fd94a38b2829231072ecbbcd2ba6f35846b14e662257e1ec14955f8d123d19e8d681a8d8854f837d16383479d3c18c8e02de6", 0x4f}, {&(0x7f0000000380)="e596d96e267015cc2ba8cec398e459e2fc39afed8d6d9922cf073ca5732b8fd611005bd84275c04bb497324c0238a97455c391601fe9deba8347fd", 0x3b}, {&(0x7f00000003c0)="3e188a59c7421bf370a71126d0f7c2247571b455bd3dfbc1f6b8cb3d23df18a3ca67778398e6ddf11cc53514ac8a3e488b3b120c34ce10a3d542b12a1a6689102791103095b7ade03d765d8fc0e7f98864c2afeb1a180a305efc451232522db7c584b6968baa9be9cc31c202152584140b67ae23fcd4efc9d997010b6ef128926021be3793c87b7ba9f7cd62457a64144ec84644d9e2ea063b1e6fafeddb5c", 0x9f}], 0x3, &(0x7f0000000600)=[{0x110, 0x102, 0x56a, "89bfa55e0a64ea00cd2253981a24d53b43d7e2bb392349de5a6be2d3e882b255b543277ee5497c33cab380eba4647a144a25d39bca8814fe6aa503ccaf22abb01e4f1942cdf1060ad728fd2b1534d5134384a3f9556f21552b7ad2ace64d5ab246cd8b08b0466f82d4579b31899ff9f9de3461459be77199841fbbe919bf5da1cf3e13ad3b430cee43bf63d0492339f9f09b9960abc0958b5f24ea81fd6c3906057b2d9d872fe17547665b819a86124de7d05e72c3588bd229b5c13256743e02f3fe55c45a84a90fe6d3bb63323cba61ed732fa09ba851e541478a468e8514f2c6fe24975c73370fa13621a75dc44063da0873a830cf7d11d48e"}, {0xd0, 0x10a, 0x24b7, "358c649efa910a189d3be80274583749923bd1bf3ee92c25e5878edad8e2f5a64acc63fd03f6bd56e47ea7dac36e0d33416e66545b7dafb3c7ccb704a3f954d0d0241438511a36921244ce38041647fedbfafa9bb97d4f639b977cdbcab9f369f368929a8d1434c24881b222e11f6cdf97a18243ff4c37dd52c0319af58974df33a7efc325bf338830a6501408148682ae8e73fb02952671a364f05cf20be07e691aa7317ff563d8441e058764ca4ad4e6ef788152924936c35984b42f01534c"}, {0x70, 0x10d, 0x0, "75d95d40629a2bac08cf10bc7a02ec28863cd469b9f5bb84f8b561f50f2419580e552d1420174d1894b16844bec8c79cb85fc249d9ad70d1d48b06ef28464b425605a9cc81dd8c674f66b31f151e2405ea0bff484700222a3cdc2e"}], 0x250}, 0x0) socket$inet6(0xa, 0xa, 0x7fff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r5 = fsopen(&(0x7f0000000080)='binfmt_misc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/diskstats\x00', 0x0, 0x0) close(r6) statx(r6, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) fsmount(r5, 0x0, 0x1) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x1c, r7, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c00)=@bpf_tracing={0x1a, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}}, 0x0, 0x5, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x13b02, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000005a0000008500000022000000180100002020702500000000002020200100000000000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x20000840) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioprio_set$pid(0x1, 0x0, 0x0) io_submit(0x0, 0x0, &(0x7f0000000840)) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x3163, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x14, &(0x7f0000001740)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) ioctl$FBIO_WAITFORVSYNC(r7, 0x40044620, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000200)=@add_del={0x2, &(0x7f0000000180)='veth0_to_batadv\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x100, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x2) executing program 4: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000900)="880100"/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x2, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) epoll_create1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) fcntl$getflags(0xffffffffffffffff, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r2]) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f0000000250)='webusb/use\x00', 0x2, 0x0) write(r2, &(0x7f0000000290)='1', 0x1) mkdirat(r1, &(0x7f00000004c0)='functions/Loopback.usb0\x00', 0x1ff) mkdirat(r1, &(0x7f0000000500)='configs/c.1\x00', 0x1ff) r3 = openat(r1, &(0x7f0000000540)='configs/c.1\x00', 0x0, 0x0) symlinkat(&(0x7f0000000680)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', r3, &(0x7f0000000700)='Loopback.usb0\x00') r4 = openat(r1, &(0x7f0000000740)='UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000000780)='usbip-vudc.0\n', 0xd) executing program 2: mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mkdir(&(0x7f0000000100)='./dev\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000600)='./dev\x00', &(0x7f0000000700)='devtmpfs\x00', 0x0, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x10800, 0x0) renameat(0xffffffffffffffff, 0x0, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0\x00', 0x42, 0x1ff) ftruncate(r1, 0x1000000) ftruncate(0xffffffffffffffff, 0x1000000) r2 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) r3 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) ftruncate(r3, 0x1000000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/loop0\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r1) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$LOOP_SET_FD(r5, 0x4c00, r2) r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r6, &(0x7f0000001100)='md0', 0x3) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./dev/md0\x00', 0x2, 0x0) ioctl(r7, 0x40140921, &(0x7f0000001500)) executing program 0: r0 = openat2(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x280, 0x100, 0x14}, 0x18) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, 0x0, 0x4048012) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002280)=ANY=[@ANYBLOB="100a"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xa, "0062ba7d82000000160000000000f738096304"}) r2 = syz_open_pts(r1, 0x900) dup3(r2, r1, 0x80000) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0xf, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r6, 0x11, 0x67, &(0x7f0000000080)=0x9, 0x4) connect$inet6(r6, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r7, 0x3b83, &(0x7f0000000040)={0x28, 0x8, 0x0, 0x0, 0x9ec4b, 0x9, 0x3, 0x3da64}) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r8) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) executing program 2: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001200)='stop', 0x4) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8090}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a50000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000240004802000018007000100637400001400028008000140000000130800024000000010140000001100010000000000000000000000000a6d34ca9009e1cdb38e04ccfdd773c710158a2088cfc65bb9d7912fc4c85cd92fc170295e2a018664d9476db54fc40ac5864fd4000042a25313"], 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x85, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x7ffe}, 0x90) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100ffffffff0000400001000000050007000000000008000900000000101400200000000000000000000000ffff0000000008000a000000000014001f0000000000000000000000000000000000060002000000000006001b004e200000050021"], 0x6c}, 0x1, 0x620b}, 0x0) r7 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r7, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket(0x2, 0x1, 0x6) bind(r8, &(0x7f00000000c0)=@in={0x2, 0x3039, @loopback}, 0x10) listen(r8, 0x1) r9 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) accept(r8, 0x0, 0x0) executing program 1: socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x0, 0x0) epoll_create1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x448101, 0x0) fcntl$setlease(r1, 0x400, 0x1) fcntl$getflags(r1, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={0xffffffffffffffff, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r3]) ioctl$RTC_ALM_READ(r5, 0x40187013, &(0x7f0000000080)) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) executing program 0: socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0xfffff274}]}}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_emit_ethernet(0x4e, &(0x7f0000000080)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x11, 0x0, 0x3, {[@window={0x3, 0x3}]}}}}}}}}, 0x0) executing program 1: r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x101000, 0x108) mkdirat(r0, &(0x7f0000002000)='./file0\x00', 0x10) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000340)=ANY=[@ANYBLOB='nr_inodes=5,size=4']) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) epoll_create1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x448101, 0x0) fcntl$setlease(r1, 0x400, 0x1) fcntl$getflags(r1, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r5, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r3]) ioctl$RTC_ALM_READ(r6, 0x40187013, &(0x7f0000000080)) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) executing program 4: r0 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, 0x0) syz_ublk_setup_io_uring(0x22cf, &(0x7f0000000240)={0x0, 0xd58c, 0x10, 0x3, 0x108}, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$radio(0x0, 0x3, 0x2) socket(0x2b, 0x1, 0x1) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x10000, 0xffffffffffffffff, 0x0, 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x5, &(0x7f0000000a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@jmp={0x6, 0x0, 0xb, 0x0, 0x0, 0x1, 0x8}, @exit]}, &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f0000000250)='webusb/use\x00', 0x2, 0x0) write(r2, &(0x7f0000000290)='1', 0x1) mkdirat(r1, &(0x7f00000004c0)='functions/Loopback.usb0\x00', 0x1ff) mkdirat(r1, &(0x7f0000000500)='configs/c.1\x00', 0x1ff) r3 = openat(r1, &(0x7f0000000540)='configs/c.1\x00', 0x0, 0x0) symlinkat(&(0x7f0000000680)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', r3, &(0x7f0000000700)='Loopback.usb0\x00') r4 = openat(r1, &(0x7f0000000740)='UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000000780)='usbip-vudc.0\n', 0xd) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) epoll_create1(0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) fcntl$getflags(0xffffffffffffffff, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r2]) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'veth1_to_hsr\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x4a88, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x10, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x4080) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x80402, 0x0) syz_open_procfs(0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$x86(r5, &(0x7f0000000080)={0x0, 0x0}) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r7, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r7, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback={0xff00000000000000}}, 0x1c) sendto$inet6(r7, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000140)={0x2, 0x0, [{0x40000001, 0x7fff, 0x4, 0x31237648, 0x6, 0x2, 0x80}, {0x40000003, 0x80000000, 0x1, 0xffff, 0xffffffff, 0x5b}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r6, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) r8 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x20000) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r8, 0x40045731, &(0x7f0000000000)) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r10, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r5, &(0x7f0000000080)={0x0, &(0x7f0000000580)=[@rdmsr={0x66, 0x18, {0x40000001}}], 0x18}) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) r11 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000380)={0x18, 0x14, 0x609, 0x0, 0x0, {0x1e}, [@generic="c1"]}, 0x18}}, 0xc044) futex_waitv(&(0x7f0000001640)=[{0x7de, &(0x7f0000000240)=0x7fffffffffffffff, 0x82}, {0x5, &(0x7f0000000280)=0x3, 0x2}, {0x8000000000000001, &(0x7f0000000640), 0x2}, {0x401, &(0x7f0000000680)=0x9, 0x80}, {0x5, &(0x7f00000006c0)=0xfffffffffffffffd, 0x82}, {0xfffffffffffffff9, &(0x7f0000000700)=0x85, 0x82}, {0x5, &(0x7f0000000740)=0x1, 0x2}, {0x7be, &(0x7f0000000780)=0xac7b, 0x82}, {0x8001, &(0x7f00000007c0)=0x8, 0x2}, {0x100000001, &(0x7f0000000800)=0x7, 0xd45305bf8da1abaa}, {0x4, &(0x7f0000000840)=0x1, 0x80}, {0x1, &(0x7f0000000880)=0xa, 0x82}, {0x7, &(0x7f00000008c0), 0x2}, {0x10000, &(0x7f0000000900)=0x3, 0x2}, {0xffffffffffffff8f, &(0x7f0000000940), 0x82}, {0x58, &(0x7f0000000980)=0x46ac, 0x2}, {0x7ff, &(0x7f0000000a80)=0x3, 0x2}, {0x2, &(0x7f0000000ac0)=0x8, 0x2}, {0x1, &(0x7f0000000b00), 0x82}, {0xffff, &(0x7f0000000b40)=0x7, 0x82}, {0x40, &(0x7f0000000b80)=0x7fffffffffffffff, 0x82}, {0xfffffffffffffffa, &(0x7f0000000bc0)=0x99, 0x2}, {0x2, &(0x7f0000000c00)=0x3, 0x82}, {0x2, &(0x7f0000000c40)=0xffffffffffffffff, 0x2}, {0x43, &(0x7f0000000c80)=0x4, 0x3}, {0x8fea, &(0x7f0000000cc0)=0x2, 0x82}, {0xfffffffffffffffd, &(0x7f0000000d00)=0xf, 0x82}, {0x9, &(0x7f0000000d40)=0x8, 0x82}, {0xa, &(0x7f0000000d80)=0x5, 0x2}, {0x401, &(0x7f0000000dc0)=0x2, 0x2}, {0x7, &(0x7f0000000e00)=0x200, 0x2}, {0x1, &(0x7f0000000e40)=0x7fffffffffffffff, 0x82}, {0x7, &(0x7f0000000e80)=0x5, 0x2}, {0x48b, &(0x7f0000000ec0)=0x7667, 0x82}, {0x0, &(0x7f0000000f00)=0x7, 0x82}, {0x0, &(0x7f0000000f40)=0x4, 0x82}, {0x8, &(0x7f0000000f80)=0x2, 0x82}, {0xc3c, &(0x7f0000000fc0)=0x6}, {0x4, &(0x7f0000001000), 0x82}, {0x6655, &(0x7f0000001040)=0x1, 0x2}, {0x40000, &(0x7f0000001080)=0x538b, 0x2}, {0x4, &(0x7f00000010c0)=0xd, 0x6}, {0x9, &(0x7f0000001100)=0x9, 0x82}, {0x0, &(0x7f0000001140)=0xfffffffffffffffb, 0x2}, {0x1, &(0x7f0000001180)=0x3, 0x82}, {0x1, &(0x7f00000011c0)=0xff, 0x2}, {0x8000000000000000, &(0x7f0000001200)=0x7, 0x82}, {0x101, &(0x7f0000001240)=0x9, 0x2}, {0x5, &(0x7f0000001280)=0x5, 0x82}, {0x3, &(0x7f0000001300)=0x8, 0x2}, {0x7, &(0x7f0000001340)=0x4, 0x82}, {0x1d3, &(0x7f0000001380)=0x1, 0x2}, {0x2, &(0x7f00000013c0)=0x6, 0x82}, {0x54, &(0x7f0000001400)=0x1c, 0x82}, {0x0, &(0x7f0000001440)=0x2, 0x2}, {0x0, &(0x7f0000001480)=0x8, 0x2}, {0x7, &(0x7f00000014c0)=0x13, 0x82}, {0x10001, &(0x7f0000001500)=0x2, 0x2}, {0x2, &(0x7f0000001540)=0xfffffffffffffffd, 0x2}, {0x9, &(0x7f0000001580)=0xa, 0x2}, {0x9, &(0x7f00000015c0)=0x7fff, 0x82}, {0x7fff, &(0x7f0000001600)=0x1, 0x82}], 0x3e, 0x0, &(0x7f0000001c40), 0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000000440)={0x40, 0x31}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f00000002c0)={0x40, 0x15}, 0x0, 0x0, 0x0, 0x0}) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX-socket-sendmsg$nl_route_sched-sendmsg$nl_route_sched-openat$kvm-syz_open_procfs-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$x86-syz_kvm_add_vcpu$x86-socket$inet6-setsockopt$inet6_int-sendto$inet6-sendto$inet6-ioctl$KVM_SET_CPUID2-ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID-syz_open_dev$amidi-ioctl$SNDRV_RAWMIDI_IOCTL_INFO-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$x86-syz_kvm_add_vcpu$x86-ioctl$KVM_RUN-syz_usb_control_io$printer-socket$netlink-sendmsg$nl_generic-futex_waitv-syz_usb_control_io-syz_usb_control_io$rtl8150 detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'veth1_to_hsr\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x4a88, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x10, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x4080) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x80402, 0x0) syz_open_procfs(0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$x86(r5, &(0x7f0000000080)={0x0, 0x0}) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r7, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r7, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback={0xff00000000000000}}, 0x1c) sendto$inet6(r7, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000140)={0x2, 0x0, [{0x40000001, 0x7fff, 0x4, 0x31237648, 0x6, 0x2, 0x80}, {0x40000003, 0x80000000, 0x1, 0xffff, 0xffffffff, 0x5b}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r6, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) r8 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x20000) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r8, 0x40045731, &(0x7f0000000000)) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r10, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r5, &(0x7f0000000080)={0x0, &(0x7f0000000580)=[@rdmsr={0x66, 0x18, {0x40000001}}], 0x18}) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) r11 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000380)={0x18, 0x14, 0x609, 0x0, 0x0, {0x1e}, [@generic="c1"]}, 0x18}}, 0xc044) futex_waitv(&(0x7f0000001640)=[{0x7de, &(0x7f0000000240)=0x7fffffffffffffff, 0x82}, {0x5, &(0x7f0000000280)=0x3, 0x2}, {0x8000000000000001, &(0x7f0000000640), 0x2}, {0x401, &(0x7f0000000680)=0x9, 0x80}, {0x5, &(0x7f00000006c0)=0xfffffffffffffffd, 0x82}, {0xfffffffffffffff9, &(0x7f0000000700)=0x85, 0x82}, {0x5, &(0x7f0000000740)=0x1, 0x2}, {0x7be, &(0x7f0000000780)=0xac7b, 0x82}, {0x8001, &(0x7f00000007c0)=0x8, 0x2}, {0x100000001, &(0x7f0000000800)=0x7, 0xd45305bf8da1abaa}, {0x4, &(0x7f0000000840)=0x1, 0x80}, {0x1, &(0x7f0000000880)=0xa, 0x82}, {0x7, &(0x7f00000008c0), 0x2}, {0x10000, &(0x7f0000000900)=0x3, 0x2}, {0xffffffffffffff8f, &(0x7f0000000940), 0x82}, {0x58, &(0x7f0000000980)=0x46ac, 0x2}, {0x7ff, &(0x7f0000000a80)=0x3, 0x2}, {0x2, &(0x7f0000000ac0)=0x8, 0x2}, {0x1, &(0x7f0000000b00), 0x82}, {0xffff, &(0x7f0000000b40)=0x7, 0x82}, {0x40, &(0x7f0000000b80)=0x7fffffffffffffff, 0x82}, {0xfffffffffffffffa, &(0x7f0000000bc0)=0x99, 0x2}, {0x2, &(0x7f0000000c00)=0x3, 0x82}, {0x2, &(0x7f0000000c40)=0xffffffffffffffff, 0x2}, {0x43, &(0x7f0000000c80)=0x4, 0x3}, {0x8fea, &(0x7f0000000cc0)=0x2, 0x82}, {0xfffffffffffffffd, &(0x7f0000000d00)=0xf, 0x82}, {0x9, &(0x7f0000000d40)=0x8, 0x82}, {0xa, &(0x7f0000000d80)=0x5, 0x2}, {0x401, &(0x7f0000000dc0)=0x2, 0x2}, {0x7, &(0x7f0000000e00)=0x200, 0x2}, {0x1, &(0x7f0000000e40)=0x7fffffffffffffff, 0x82}, {0x7, &(0x7f0000000e80)=0x5, 0x2}, {0x48b, &(0x7f0000000ec0)=0x7667, 0x82}, {0x0, &(0x7f0000000f00)=0x7, 0x82}, {0x0, &(0x7f0000000f40)=0x4, 0x82}, {0x8, &(0x7f0000000f80)=0x2, 0x82}, {0xc3c, &(0x7f0000000fc0)=0x6}, {0x4, &(0x7f0000001000), 0x82}, {0x6655, &(0x7f0000001040)=0x1, 0x2}, {0x40000, &(0x7f0000001080)=0x538b, 0x2}, {0x4, &(0x7f00000010c0)=0xd, 0x6}, {0x9, &(0x7f0000001100)=0x9, 0x82}, {0x0, &(0x7f0000001140)=0xfffffffffffffffb, 0x2}, {0x1, &(0x7f0000001180)=0x3, 0x82}, {0x1, &(0x7f00000011c0)=0xff, 0x2}, {0x8000000000000000, &(0x7f0000001200)=0x7, 0x82}, {0x101, &(0x7f0000001240)=0x9, 0x2}, {0x5, &(0x7f0000001280)=0x5, 0x82}, {0x3, &(0x7f0000001300)=0x8, 0x2}, {0x7, &(0x7f0000001340)=0x4, 0x82}, {0x1d3, &(0x7f0000001380)=0x1, 0x2}, {0x2, &(0x7f00000013c0)=0x6, 0x82}, {0x54, &(0x7f0000001400)=0x1c, 0x82}, {0x0, &(0x7f0000001440)=0x2, 0x2}, {0x0, &(0x7f0000001480)=0x8, 0x2}, {0x7, &(0x7f00000014c0)=0x13, 0x82}, {0x10001, &(0x7f0000001500)=0x2, 0x2}, {0x2, &(0x7f0000001540)=0xfffffffffffffffd, 0x2}, {0x9, &(0x7f0000001580)=0xa, 0x2}, {0x9, &(0x7f00000015c0)=0x7fff, 0x82}, {0x7fff, &(0x7f0000001600)=0x1, 0x82}], 0x3e, 0x0, &(0x7f0000001c40), 0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000000440)={0x40, 0x31}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f00000002c0)={0x40, 0x15}, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-socket$rds-io_submit-epoll_create1-bpf$PROG_LOAD-prlimit64-sched_setscheduler-removexattr-sched_setaffinity-prctl$PR_SCHED_CORE-syz_open_dev$MSR-fcntl$setlease-fcntl$getflags-read$msr-socket$inet6_tcp-setsockopt$inet6_tcp_int-socket$inet6_mptcp-connect$inet6-socket$netlink-writev-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$IOC_WATCH_QUEUE_SET_FILTER-mount detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) epoll_create1(0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) fcntl$getflags(0xffffffffffffffff, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r2]) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$media-ioctl$MEDIA_IOC_REQUEST_ALLOC-syz_ublk_setup_io_uring-bpf$BPF_BTF_LOAD-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-syz_open_dev$radio-socket-syz_open_dev$vim2m-pselect6-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-ioctl$VIDIOC_G_EXT_CTRLS-socket$nl_generic-ioctl$sock_SIOCGIFINDEX-bpf$PROG_LOAD_XDP-syz_open_dev$usbfs-ioctl$USBDEVFS_IOCTL detailed listing: executing program 0: r0 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, 0x0) syz_ublk_setup_io_uring(0x22cf, &(0x7f0000000240)={0x0, 0xd58c, 0x10, 0x3, 0x108}, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$radio(0x0, 0x3, 0x2) socket(0x2b, 0x1, 0x1) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x10000, 0xffffffffffffffff, 0x0, 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x5, &(0x7f0000000a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@jmp={0x6, 0x0, 0xb, 0x0, 0x0, 0x1, 0x8}, @exit]}, &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-mkdirat-mount-write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001200)='stop', 0x4) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in cxacru_poll_status single: successfully extracted reproducer found reproducer with 13 syscalls minimizing guilty program testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-mkdirat-mount-write detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001200)='stop', 0x4) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-mkdirat-mount-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in cxacru_poll_status testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-mkdirat-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in cxacru_poll_status testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in cxacru_poll_status testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(0xffffffffffffffff, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000100)) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000300)) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000a00)) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read program did not crash simplifying guilty program options testing program (duration=1m59.069791075s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in cxacru_poll_status extracting C reproducer testing compiled C program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read program did not crash testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in cxacru_poll_status validation run: crashed=true testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in cxacru_poll_status validation run: crashed=true testing program (duration=1m59.069791075s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_write-syz_usb_ep_read detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in cxacru_poll_status validation run: crashed=true reproducing took 1h26m42.609467764s repro crashed as (corrupted=false): ATM dev 0: poll status: error -71 ATM dev 0: polling disabled, set adsl_state to 'start' or 'poll' to resume ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15ca/0x1bd0 kernel/locking/mutex.c:821 Read of size 8 at addr ffff88807d29c218 by task kworker/0:0/9 CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: events cxacru_poll_status Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x15ca/0x1bd0 kernel/locking/mutex.c:821 cxacru_poll_status+0x55b/0xdc0 drivers/usb/atm/cxacru.c:920 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 9: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] cxacru_bind+0xac/0x1440 drivers/usb/atm/cxacru.c:1133 usbatm_usb_probe+0x378/0x1b50 drivers/usb/atm/usbatm.c:1058 cxacru_usb_probe+0x101/0x200 drivers/usb/atm/cxacru.c:1370 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x30a3/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 10: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x22b/0x6c0 mm/slub.c:6692 cxacru_unbind+0x1fc/0x3d0 drivers/usb/atm/cxacru.c:1266 usbatm_usb_disconnect+0x449/0x7e0 drivers/usb/atm/usbatm.c:1255 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:618 [inline] device_remove+0x12a/0x180 drivers/base/dd.c:610 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664 device_del+0x376/0x9b0 drivers/base/core.c:3961 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1c4f/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Last potentially related work creation: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 insert_work+0x36/0x230 kernel/workqueue.c:2226 __queue_work+0x9bc/0x12b0 kernel/workqueue.c:2401 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1794 [inline] __run_timers+0x570/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 The buggy address belongs to the object at ffff88807d29c000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 536 bytes inside of freed 1024-byte region [ffff88807d29c000, ffff88807d29c400) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d298 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813fe23dc0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813fe23dc0 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5629, tgid 5629 (syz-executor), ts 69989088439, free_ts 68776617028 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x640 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] afs_alloc_call+0x51/0x640 fs/afs/rxrpc.c:171 afs_charge_preallocation+0x14e/0x360 fs/afs/rxrpc.c:755 afs_open_socket+0x31e/0x3f0 fs/afs/rxrpc.c:112 afs_net_init+0x825/0xb00 fs/afs/main.c:116 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137 setup_net+0x118/0x3a0 net/core/net_namespace.c:446 copy_net_ns+0x46f/0x7c0 net/core/net_namespace.c:579 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0xf2/0x220 kernel/nsproxy.c:234 page last free pid 5618 tgid 5618 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 __folio_put+0x3b4/0x5f0 mm/swap.c:112 folio_put include/linux/mm.h:2124 [inline] put_page include/linux/mm.h:2193 [inline] put_netmem include/net/netmem.h:394 [inline] skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x649/0x8e0 net/core/skbuff.c:1110 skb_release_all net/core/skbuff.c:1191 [inline] __kfree_skb+0x4f/0x70 net/core/skbuff.c:1205 tcp_wmem_free_skb include/net/tcp.h:334 [inline] tcp_rtx_queue_unlink_and_free include/net/tcp.h:2321 [inline] tcp_clean_rtx_queue net/ipv4/tcp_input.c:3698 [inline] tcp_ack+0x2079/0x7650 net/ipv4/tcp_input.c:4400 tcp_rcv_established+0x84f/0x3990 net/ipv4/tcp_input.c:6678 tcp_v4_do_rcv+0xbb6/0x1260 net/ipv4/tcp_ipv4.c:1854 sk_backlog_rcv include/net/sock.h:1190 [inline] __release_sock+0x35a/0x440 net/core/sock.c:3261 release_sock+0x1e5/0x280 net/core/sock.c:3860 tcp_sendmsg+0x38/0x50 net/ipv4/tcp.c:1452 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:865 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg net/socket.c:790 [inline] sock_write_iter+0x4ea/0x5b0 net/socket.c:1241 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x1f8/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88807d29c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807d29c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807d29c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807d29c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807d29c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ATM dev 0: poll status: error -71 ATM dev 0: polling disabled, set adsl_state to 'start' or 'poll' to resume ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15ca/0x1bd0 kernel/locking/mutex.c:821 Read of size 8 at addr ffff88807d29c218 by task kworker/0:0/9 CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: events cxacru_poll_status Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x15ca/0x1bd0 kernel/locking/mutex.c:821 cxacru_poll_status+0x55b/0xdc0 drivers/usb/atm/cxacru.c:920 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 9: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] cxacru_bind+0xac/0x1440 drivers/usb/atm/cxacru.c:1133 usbatm_usb_probe+0x378/0x1b50 drivers/usb/atm/usbatm.c:1058 cxacru_usb_probe+0x101/0x200 drivers/usb/atm/cxacru.c:1370 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x30a3/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 10: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x22b/0x6c0 mm/slub.c:6692 cxacru_unbind+0x1fc/0x3d0 drivers/usb/atm/cxacru.c:1266 usbatm_usb_disconnect+0x449/0x7e0 drivers/usb/atm/usbatm.c:1255 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:618 [inline] device_remove+0x12a/0x180 drivers/base/dd.c:610 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664 device_del+0x376/0x9b0 drivers/base/core.c:3961 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1c4f/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Last potentially related work creation: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 insert_work+0x36/0x230 kernel/workqueue.c:2226 __queue_work+0x9bc/0x12b0 kernel/workqueue.c:2401 call_timer_fn+0x19a/0x610 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1794 [inline] __run_timers+0x570/0xb00 kernel/time/timer.c:2374 __run_timer_base kernel/time/timer.c:2386 [inline] __run_timer_base kernel/time/timer.c:2378 [inline] run_timer_base+0x114/0x190 kernel/time/timer.c:2395 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 The buggy address belongs to the object at ffff88807d29c000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 536 bytes inside of freed 1024-byte region [ffff88807d29c000, ffff88807d29c400) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d298 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813fe23dc0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813fe23dc0 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5629, tgid 5629 (syz-executor), ts 69989088439, free_ts 68776617028 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x640 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x479/0x6c0 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] afs_alloc_call+0x51/0x640 fs/afs/rxrpc.c:171 afs_charge_preallocation+0x14e/0x360 fs/afs/rxrpc.c:755 afs_open_socket+0x31e/0x3f0 fs/afs/rxrpc.c:112 afs_net_init+0x825/0xb00 fs/afs/main.c:116 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137 setup_net+0x118/0x3a0 net/core/net_namespace.c:446 copy_net_ns+0x46f/0x7c0 net/core/net_namespace.c:579 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0xf2/0x220 kernel/nsproxy.c:234 page last free pid 5618 tgid 5618 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950 __folio_put+0x3b4/0x5f0 mm/swap.c:112 folio_put include/linux/mm.h:2124 [inline] put_page include/linux/mm.h:2193 [inline] put_netmem include/net/netmem.h:394 [inline] skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x649/0x8e0 net/core/skbuff.c:1110 skb_release_all net/core/skbuff.c:1191 [inline] __kfree_skb+0x4f/0x70 net/core/skbuff.c:1205 tcp_wmem_free_skb include/net/tcp.h:334 [inline] tcp_rtx_queue_unlink_and_free include/net/tcp.h:2321 [inline] tcp_clean_rtx_queue net/ipv4/tcp_input.c:3698 [inline] tcp_ack+0x2079/0x7650 net/ipv4/tcp_input.c:4400 tcp_rcv_established+0x84f/0x3990 net/ipv4/tcp_input.c:6678 tcp_v4_do_rcv+0xbb6/0x1260 net/ipv4/tcp_ipv4.c:1854 sk_backlog_rcv include/net/sock.h:1190 [inline] __release_sock+0x35a/0x440 net/core/sock.c:3261 release_sock+0x1e5/0x280 net/core/sock.c:3860 tcp_sendmsg+0x38/0x50 net/ipv4/tcp.c:1452 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:865 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg net/socket.c:790 [inline] sock_write_iter+0x4ea/0x5b0 net/socket.c:1241 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x1f8/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88807d29c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807d29c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807d29c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807d29c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807d29c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================