Extracting prog: 6m0.322506682s Minimizing prog: 43m49.562502947s Simplifying prog options: 0s Extracting C: 2m46.894239839s Simplifying C: 13m22.73216207s extracting reproducer from 40 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash single: failed to extract reproducer bisect: bisecting 40 programs with base timeout 30s testing program (duration=40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 16, 7, 10, 15, 18, 11, 28, 8, 9, 2, 4, 31, 2, 4, 4, 20, 12, 4, 5, 18, 16, 5, 3, 16, 18, 3, 5, 7, 5, 18, 4, 3, 10, 8, 10, 9, 21, 11, 6] detailed listing: executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000005c0)='syz_tun\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x24000840, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x3d2, &(0x7f00000000c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @gre={{0x23, 0x4, 0x0, 0x29, 0x3c4, 0x65, 0x0, 0x4, 0x2f, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x21}, {[@timestamp_prespec={0x44, 0x24, 0xa0, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0x14}, 0x101}, {@private=0xa010102, 0xfffffffa}, {@multicast2, 0x40}, {@remote, 0x5}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x4, 0x95, 0x1, 0x7}, @noop, @ra={0x94, 0x4}, @ssrr={0x89, 0x1b, 0x57, [@initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x44}, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, @remote]}, @timestamp_prespec={0x44, 0x4, 0xa8, 0x3, 0xc}, @timestamp={0x44, 0x8, 0x28, 0x0, 0xb, [0x2]}, @timestamp={0x44, 0xc, 0xc0, 0x0, 0x7, [0x3, 0x5]}, @timestamp_prespec={0x44, 0x14, 0x78, 0x3, 0x6, [{@rand_addr=0x64010101, 0x9}, {@multicast1, 0x1}]}]}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0xa6, 0x3, [], "461a09e2cfaf0ba4f955000cb5b1d55da61f3a876848a03f4b6b44770eca0fec0dae8364f994307fe74bdfc0c2ecfa7794a6de9d26b9c14a53247da8ae79853f6bc2eaca792469e81d718bfdc6e1c6d49cc83d87ddad409cd03e082f97908625b0748a6576f95d3580ec864cd13f22515f396e1a83fd4bfd2cd2297f47c759090d6fa41e9572d5ec11a943ecda1b8ba52bff69d667a4fa6fa7f6bf026d891eaa8ea66e2d7a50"}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [0xc], "bfdf3d15e9e924d64c3ca93407368c3690e96f344993dd1a270e97e4787e777a041ad9f0e280221f3b16f4eefd1404834f519137c8329f185dcfb24b9657dfee75674f5f84241322e700a5d3e925fa01d4ea894a4062c4fe797e2743ef953c85caa519d88703a4c1804a07fcc19fd44f00a8931f57794ed2a10c7f0b4834a8793952c174248d91a4e8191faa1ab7cb34df3147747951d0f7b1f77f768c8d94712025d5303de0"}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0x8, 0xb], "d50f98d46259b38048d42e6cd1c0af174e28241a2a2b770e5ecb574fe10072c5a39458e8fa6e0611c6585eb81a67f1c92bd57f3fefd3085467ccac3ccfa980e23a0af5ffa2ce27cbc32a332c77d199138b2a004f81a86e85c4205e8dcc33be42c7dd6f98297cffc3caf4a37b901ef7f28cea74aee33b12ddc343c2e740c56b39d14d0bd764f21f65d0ea691acd48b98954d6f09f211cb871271541b91b99c4228317420394dcace9075150919be05328742a4a7e101c"}, {0x8, 0x88be, 0x3, {{0x1, 0x1, 0x4, 0x3, 0x1, 0x3, 0x4, 0xf}, 0x1, {0xc34}}}, {0x8, 0x22eb, 0x0, {{0x3, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7, 0x81}, 0x2, {0xfffffffc, 0x1, 0x1, 0x8, 0x0, 0x0, 0x3}}}, {0x8, 0x6558, 0x1, "635e6eca6029e1bcbb30cdb3792c475fdb3c424ec076305949fb195a52830a5df14c8c1a36f54a9e7576aa1ce36814c428e6d52a6fef122287ddf96015091e3c8aaa40571495a7417164927825218418d2bf7072478eb6c08d27f69f3ebf14756e5961a52f4bcdf0ac833356ccab201ebcea44ce7fd0c80ba0fa2c1857aa6c9e4c324a2e1236cda878e833e44f54cf5c200c86790bddd5b703043e271e23de9f0cc114178e3df8a8703c7caf4646511d126929d6b5c4beb751908a06638aab5b07e28ac88d34ea1c521213f7e087b300eaca5205069cfff788f6a0a29f4f9bb5512358fbc1ba61ad9e2785cc"}}}}}}, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000600)="9a", 0x1) syz_emit_ethernet(0x36, &(0x7f0000000500)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x2, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x0, 0xfffd, 0x0, 0x7}}}}}}, 0x0) executing program 4: openat(0xffffffffffffff9c, 0x0, 0x105042, 0x1db) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r3 = accept(r1, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x12, 0x14, 0x4, 0x5}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r4, &(0x7f0000000300), &(0x7f00000002c0)=@tcp6=r3}, 0x20) read$FUSE(r3, &(0x7f0000005440)={0x2020}, 0x2020) close_range(r0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x2000, 0x1d) executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000800)='./export_dir\x00', 0xc2, 0x0) mkdir(&(0x7f0000000e00)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000001000)='./proc_dir\x00', &(0x7f0000001100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./proc_dir/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000001300)='nfsd 127.0.0.1 2000000000 *\n', 0x1c) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc_dir/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000b00)='* ./export_dir \\000000000 8194 0 0 0\n', 0x25) executing program 4: mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)="62f5ff6ccf3d2ec97f0e4bc8a900d2bd65ddd28d9c642869255bb3d50995a0f8ee0244972a44172334670879c539e6d89b62e92a4f10a4de102e99846b5a9519a6ea42983dcd33895c147569e2e993", 0x4f) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) read(r2, &(0x7f0000000180), 0x1000) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd21, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0xc, 0xfff2}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0xb, 0x9}, {}, {0xfff2, 0x2}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r9, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) executing program 4: openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f00004c7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f00002da000/0x1000)=nil, &(0x7f0000081000/0x11000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f000076e000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) executing program 3: creat(&(0x7f00000008c0)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) rename(0x0, &(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) read$ptp(0xffffffffffffffff, &(0x7f0000000000)=""/60, 0x3c) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1001f0) open(&(0x7f00000001c0)='./file1\x00', 0x101000, 0x4) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000031d414000380100000800c00018006000100d103"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x20, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20008060}, 0x4000800) timerfd_gettime(0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x803, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000000)) r4 = socket$can_bcm(0x1d, 0x2, 0x2) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='debugfs\x00', 0x0, 0x0) r5 = inotify_init1(0x0) r6 = inotify_add_watch(r5, &(0x7f00000000c0)='./file0\x00', 0x24000408) inotify_rm_watch(r5, r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0xfff) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000140)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a35f2", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8923, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) executing program 3: r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000005e00)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd26, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0xa4, 0x0, 0x4000}}, @TCA_TBF_BURST={0x8, 0x6, 0x12}]}}]}, 0x60}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000140)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x6c, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x8, 0x2, 0x2, 0x5, 0x6ccf, 0x6}, {0x1, 0x2, 0xfffc, 0xa535, 0x8, 0x228}, 0x6, 0x6, 0x6a1}}, @TCA_TBF_BURST={0x8, 0x6, 0x2}, @TCA_TBF_PRATE64={0xc, 0x5, 0xdcebd51a7f62bc27}]}}]}, 0x6c}}, 0x0) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x14, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x4000080) ioctl$sock_SIOCBRDELBR(r1, 0x89a2, &(0x7f0000000000)='bridge0\x00') r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000001010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) executing program 1: r0 = socket(0x2, 0x2, 0x0) connect(r0, &(0x7f0000000080)=@in={0x2, 0x4e20, @loopback}, 0x10) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x10, 0x0, 0x0}) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0x17b3\n\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='0x0004\n\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='ACME\n\x00', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)='ACMESynth\n\x00', 0xa) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n\x00', 0xc) close(r4) nanosleep(&(0x7f0000000700)={0x0, 0x1dcd6500}, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f0000000800), 0x0, 0x2) write$midi(r5, &(0x7f0000000900)='12345678', 0x8) nanosleep(&(0x7f0000000700)={0x0, 0xbebc200}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000000b00)='\n\x00', 0x1) close(r6) nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0) executing program 1: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f00000035c0)={0x0, {0x2, 0x4e23, @loopback}, {0x2, 0x4e21, @multicast2}, {0x2, 0x4e20, @remote}, 0x246, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x5, 0x8, 0xd1dd}) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)={0x1c, 0x27, 0x9, 0x70bd2d, 0x25dfdbfe, {0x2}, [@typed={0x8, 0x1, 0x0, 0x0, @pid=0xffffffffffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4040030) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newlink={0x38, 0x10, 0x437, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x38}}, 0x0) executing program 2: r0 = socket(0x10, 0x803, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newlink={0x50, 0x10, 0x437, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x50483}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x24, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8}, @IFLA_HSR_VERSION={0x5, 0x6, 0x6}, @IFLA_HSR_SLAVE1={0x8, 0x1, r2}, @IFLA_HSR_PROTOCOL={0x5, 0x7, 0x1}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1234567890\x00', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='Linux Foundation\x00', 0x11) openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000500)='Conf 1\x00', 0x7) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff) executing program 1: r0 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) syz_usb_connect$cdc_ecm(0x2, 0x0, 0x0, 0x0) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1a3, 0x655c, 0x4, 0x40, 0x7fffffff, 0x7fffffff, 0x80, 0xffffffff, 0x1}}}}]}, 0x58}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {0xe}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x15864}]}}]}, 0x44}}, 0x4000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0002"], 0x1c}, 0x1, 0x0, 0x0, 0x4010}, 0x4) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmmsg$inet(r0, &(0x7f0000005240), 0x4000095, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x224e}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xcb}}}}}}, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x48000) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x80002, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x0, 0x28) fcntl$dupfd(r0, 0x0, r0) socket$inet6_udp(0xa, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x121a03, 0x0) fsopen(&(0x7f00000003c0)='sysfs\x00', 0x1) syz_open_procfs(0x0, &(0x7f0000000040)='timerslack_ns\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) socket(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYRES64=r1], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r3, 0x541c, &(0x7f0000000000)) executing program 2: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1', 0x1) unshare(0x44040200) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write(r1, &(0x7f0000000240)='100', 0x3) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x4000) socket$nl_generic(0x10, 0x3, 0x10) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r0, &(0x7f0000000400)=[{&(0x7f00000001c0)="2e9b3d0007e03dd651", 0x9}, {&(0x7f0000000340)="5a28ad33f107f6176a", 0x9}], 0x2) executing program 1: r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x10000, @local, 0x2}, 0x1c) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x24004081) executing program 32: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1', 0x1) unshare(0x44040200) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write(r1, &(0x7f0000000240)='100', 0x3) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x4000) socket$nl_generic(0x10, 0x3, 0x10) executing program 33: bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x80002, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x0, 0x28) fcntl$dupfd(r0, 0x0, r0) socket$inet6_udp(0xa, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x121a03, 0x0) fsopen(&(0x7f00000003c0)='sysfs\x00', 0x1) syz_open_procfs(0x0, &(0x7f0000000040)='timerslack_ns\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) socket(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000140)=ANY=[@ANYRES64=r1], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r3, 0x541c, &(0x7f0000000000)) executing program 34: r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x10000, @local, 0x2}, 0x1c) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x24004081) executing program 35: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r0, &(0x7f0000000400)=[{&(0x7f00000001c0)="2e9b3d0007e03dd651", 0x9}, {&(0x7f0000000340)="5a28ad33f107f6176a", 0x9}], 0x2) executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x280a00, 0x0) file_getattr(r1, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x18, 0x100) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newlink={0x50, 0x10, 0x437, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x50483}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x24, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8, 0x2, r1}, @IFLA_HSR_VERSION={0x5, 0x6, 0x6}, @IFLA_HSR_SLAVE1={0x8}, @IFLA_HSR_PROTOCOL={0x5, 0x7, 0x1}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) executing program 5: r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r0, 0x8) landlock_restrict_self(r1, 0x6) landlock_restrict_self(r1, 0x5) landlock_restrict_self(r1, 0x4) landlock_restrict_self(r1, 0x5) landlock_restrict_self(r1, 0x1) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0xc) landlock_restrict_self(r1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='wchan\x00') executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000280)={0x1, 0x4, 0x1}) r1 = dup(r0) write$UHID_INPUT(r1, &(0x7f00000002c0)={0x9, {"a2e3ad214fc752f91b2547f70e06d038e7ff7fc6e5539b325d078b089b3b083872090890e0878f0e1ac6e7049b3367959b669a240d5b67f3988f7e0319520100ffe8d178708c523c921b1b5b31340d095d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4040d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d606495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07840900000000000000f5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a605fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) executing program 0: mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f00000000c0)=0xffffffff, 0x4) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file3\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file3\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file2'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./file3\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./reg_file\x00', 0x42, 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f0000000300)='./fifo_file\x00', 0x1000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./fifo_file\x00', 0x802, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000400)={0x0, 0x0, 0x1, 0x0, 0x0, [{{r1}}]}) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000000)=ANY=[@ANYBLOB="00020401"], 0x18) connect$inet6(r1, &(0x7f0000001940)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000001840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) executing program 5: r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r1, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000880)=ANY=[@ANYBLOB="120100020000000882052500400001020301090271"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) executing program 0: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e24, 0xfffffffa, @empty, 0x8001}, 0x1c) listen(r1, 0x0) sendmmsg$inet(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10, 0x0}}], 0x1, 0x2000c000) listen(0xffffffffffffffff, 0x7d4165c9) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='add 1-1\x00', 0x8) write(r0, 0x0, 0x0) write(r0, &(0x7f00000001c0)='add 3-1\x00', 0x8) write(r0, &(0x7f0000000200)='add 4-1\x00', 0x8) write(r0, &(0x7f0000000240)='add 5-1\x00', 0x8) write(r0, &(0x7f0000000280)='add 6-1\x00', 0x8) write(r0, &(0x7f00000002c0)='add 7-1\x00', 0x8) write(r0, &(0x7f0000000300)='add 8-1\x00', 0x8) write(r0, &(0x7f0000000340)='add 1-2\x00', 0x8) write(r0, &(0x7f0000000380)='add 2-2\x00', 0x8) write(r0, &(0x7f00000003c0)='add 3-2\x00', 0x8) write(r0, &(0x7f0000000400)='add 4-2\x00', 0x8) write(r0, &(0x7f0000000440)='add 5-2\x00', 0x8) write(r0, &(0x7f0000000480)='add 6-2\x00', 0x8) write(r0, &(0x7f00000004c0)='add 7-2\x00', 0x8) write(r0, &(0x7f0000000500)='add 8-2\x00', 0x8) syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="1201000029be0008110700096ffa010203010902240001000000000904970002ffffff000905041020000637460905de24"], 0x0) nanosleep(&(0x7f0000000580)={0x1}, 0x0) executing program 0: close(0x3) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x1000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000fea000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2b, &(0x7f0000000180)={0x6, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast1}}}, 0x108) r1 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) io_uring_enter(r1, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) executing program 7: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program crashed: WARNING in virtio_dev_remove single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-pwrite64-openat-write detailed listing: executing program 0: mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(0x0, 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program crashed: WARNING in virtio_dev_remove testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, 0x0, 0x0, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180), 0x0, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write program crashed: WARNING in virtio_dev_remove simplifying C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write program crashed: WARNING in virtio_dev_remove testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write program crashed: WARNING in virtio_dev_remove testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write program crashed: WARNING in virtio_dev_remove testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write program crashed: WARNING in virtio_dev_remove testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write program crashed: WARNING in virtio_dev_remove testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write program crashed: WARNING in virtio_dev_remove testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write program crashed: WARNING in virtio_dev_remove testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program crashed: WARNING in virtio_dev_remove validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program crashed: WARNING in virtio_dev_remove validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount-openat-pwrite64-openat-write detailed listing: executing program 0: mkdir(&(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='sys/bus/pci/devices/0000:00:04.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\x00\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) program crashed: WARNING in virtio_dev_remove validation run: crashed=true reproducing took 1h11m52.461354521s repro crashed as (corrupted=false): ------------[ cut here ]------------ dev->config->get_status(dev) WARNING: drivers/virtio/virtio.c:378 at virtio_dev_remove+0x18b/0x1b0 drivers/virtio/virtio.c:378, CPU#0: syz.0.17/5908 Modules linked in: CPU: 0 UID: 0 PID: 5908 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:virtio_dev_remove+0x18b/0x1b0 drivers/virtio/virtio.c:378 Code: 4c 89 f7 2e 2e 2e 41 ff d3 0c 01 0f b6 f0 4c 89 f7 4d 89 fb 5b 41 5c 41 5d 41 5e 41 5f 5d 2e e9 cb 7e c1 1a e8 96 50 87 fc 90 <0f> 0b 90 e9 6e ff ff ff 44 89 e9 80 e1 07 38 c1 0f 8c c2 fe ff ff RSP: 0018:ffffc9000396f7d8 EFLAGS: 00010293 RAX: ffffffff853e8a5a RBX: ffff8880207986d0 RCX: ffff88802daa9f00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000000000ff R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8540e710 R12: 1ffff110040f30da R13: dffffc0000000000 R14: ffff888020798000 R15: ffffffff8bd67c98 FS: 000055555e6de500(0000) GS:ffff888125c41000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f75b8f257d0 CR3: 00000000385b4000 CR4: 00000000003526f0 Call Trace: device_remove drivers/base/dd.c:616 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372 bus_remove_device+0x449/0x560 drivers/base/bus.c:664 device_del+0x528/0x8f0 drivers/base/core.c:3961 device_unregister+0x21/0xf0 drivers/base/core.c:4002 unregister_virtio_device+0x37/0x60 drivers/virtio/virtio.c:594 virtio_pci_remove+0x7f/0xf0 drivers/virtio/virtio_pci_common.c:758 pci_device_remove+0x99/0x1c0 drivers/pci/pci-driver.c:512 device_remove drivers/base/dd.c:616 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372 pci_stop_dev drivers/pci/remove.c:27 [inline] pci_stop_bus_device+0xf6/0x120 drivers/pci/remove.c:93 pci_stop_and_remove_bus_device drivers/pci/remove.c:128 [inline] pci_stop_and_remove_bus_device_locked+0x77/0xb0 drivers/pci/remove.c:136 remove_store+0xe5/0x150 drivers/pci/pci-sysfs.c:523 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x61e/0xbb0 fs/read_write.c:687 ksys_write+0x156/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f892436df99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe55ba0898 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f89245f5fa0 RCX: 00007f892436df99 RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000004 RBP: 00007f8924404ec4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f89245f5fac R14: 00007f89245f5fa0 R15: 00007f89245f5fa0 final repro crashed as (corrupted=false): ------------[ cut here ]------------ dev->config->get_status(dev) WARNING: drivers/virtio/virtio.c:378 at virtio_dev_remove+0x18b/0x1b0 drivers/virtio/virtio.c:378, CPU#0: syz.0.17/5908 Modules linked in: CPU: 0 UID: 0 PID: 5908 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:virtio_dev_remove+0x18b/0x1b0 drivers/virtio/virtio.c:378 Code: 4c 89 f7 2e 2e 2e 41 ff d3 0c 01 0f b6 f0 4c 89 f7 4d 89 fb 5b 41 5c 41 5d 41 5e 41 5f 5d 2e e9 cb 7e c1 1a e8 96 50 87 fc 90 <0f> 0b 90 e9 6e ff ff ff 44 89 e9 80 e1 07 38 c1 0f 8c c2 fe ff ff RSP: 0018:ffffc9000396f7d8 EFLAGS: 00010293 RAX: ffffffff853e8a5a RBX: ffff8880207986d0 RCX: ffff88802daa9f00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000000000ff R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8540e710 R12: 1ffff110040f30da R13: dffffc0000000000 R14: ffff888020798000 R15: ffffffff8bd67c98 FS: 000055555e6de500(0000) GS:ffff888125c41000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f75b8f257d0 CR3: 00000000385b4000 CR4: 00000000003526f0 Call Trace: device_remove drivers/base/dd.c:616 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372 bus_remove_device+0x449/0x560 drivers/base/bus.c:664 device_del+0x528/0x8f0 drivers/base/core.c:3961 device_unregister+0x21/0xf0 drivers/base/core.c:4002 unregister_virtio_device+0x37/0x60 drivers/virtio/virtio.c:594 virtio_pci_remove+0x7f/0xf0 drivers/virtio/virtio_pci_common.c:758 pci_device_remove+0x99/0x1c0 drivers/pci/pci-driver.c:512 device_remove drivers/base/dd.c:616 [inline] __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372 pci_stop_dev drivers/pci/remove.c:27 [inline] pci_stop_bus_device+0xf6/0x120 drivers/pci/remove.c:93 pci_stop_and_remove_bus_device drivers/pci/remove.c:128 [inline] pci_stop_and_remove_bus_device_locked+0x77/0xb0 drivers/pci/remove.c:136 remove_store+0xe5/0x150 drivers/pci/pci-sysfs.c:523 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x61e/0xbb0 fs/read_write.c:687 ksys_write+0x156/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f892436df99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe55ba0898 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f89245f5fa0 RCX: 00007f892436df99 RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000004 RBP: 00007f8924404ec4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f89245f5fac R14: 00007f89245f5fa0 R15: 00007f89245f5fa0